Executive Summary

The Fortis for WooCommerce WordPress plugin versions before 1.3.1 have a vulnerability that may leak sensitive API keys to unauthenticated attackers.

These leaked API keys allow attackers to query Fortis' API and retrieve sensitive customer information such as past orders and personally identifiable information (PII).

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can lead to unauthorized access to sensitive customer data including past orders and PII.

Attackers can exploit the leaked API keys to query the Fortis API without authentication, potentially resulting in data breaches and privacy violations.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by attempting to reproduce the proof of concept attack which involves querying the vulnerable endpoint to check if sensitive API keys are exposed.

One suggested command to test this is to run the following in your browser's console while on the affected WooCommerce site:

• await fetch("/wp-admin/admin-ajax.php?action=fortis_ajax_request", { "credentials": "include", "method": "POST" })

If the response contains sensitive API keys or customer information, the vulnerability is present.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability allows unauthenticated attackers to access sensitive API keys and retrieve sensitive customer information, including personally identifiable information (PII) and past orders.

Exposure of PII and customer data can lead to non-compliance with data protection regulations such as GDPR and HIPAA, which require safeguarding personal and sensitive information against unauthorized access.

Therefore, exploitation of this vulnerability could result in violations of these standards, potentially leading to legal and financial consequences for affected organizations.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability, immediately update the Fortis for WooCommerce WordPress plugin to version 1.3.1 or later, as versions before 1.3.1 are vulnerable to sensitive API key disclosure.

If updating is not immediately possible, consider temporarily disabling the plugin or restricting access to the affected AJAX endpoint to authenticated users only to prevent unauthenticated attackers from exploiting the vulnerability.

Useful 0 Not Useful 0