CVE-2026-24553
BaseFortify
Publication date: 2026-01-23
Last updated on: 2026-04-01
Assigner: Patchstack
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| dotstore | fraud_prevention_for_woocommerce | to 2.3.1 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-497 | The product does not properly prevent sensitive system-level information from being accessed by unauthorized actors who do not have the same level of access to the underlying system as the product does. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability is a Sensitive Data Exposure issue in the WordPress plugin 'Fraud Prevention For Woocommerce' (versions up to 2.3.1). It allows a malicious user with subscriber-level privileges to access sensitive system information that should normally be restricted. This exposure could potentially lead to exploitation of other system weaknesses. The vulnerability is classified under OWASP Top 10 category A3: Sensitive Data Exposure and has a low severity with a CVSS score of 4.3. [1]
How can this vulnerability impact me? :
The vulnerability could allow unauthorized users to retrieve sensitive information from the system, which might be used to exploit other weaknesses. However, the overall impact is considered low and exploitation is unlikely. It requires only subscriber-level access to exploit, so if an attacker gains such access, they could potentially access restricted data. [1]
What immediate steps should I take to mitigate this vulnerability?
Since no official fix or patched version is currently available for this vulnerability, immediate mitigation steps include limiting subscriber-level privileges to trusted users only and monitoring access to sensitive data. Additionally, using Patchstack's mitigation services may help reduce risk until a patch is released. [1]
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The provided resources do not specify how this vulnerability affects compliance with common standards and regulations such as GDPR or HIPAA.