Unauthenticated Phone Number Lookup in ShopSmart Loyalty for WooCommerce

Executive Summary

The ShopSmart Loyalty for WooCommerce plugin has an unauthenticated sensitive information disclosure vulnerability. Attackers can access customer loyalty profiles, including names, email addresses, and account balances, by knowing a customer's phone number through the exposed 'shopsmart_check_phone' function. No authorization checks are performed.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, check if the 'shopsmart_check_phone' function in the ShopSmart Loyalty for WooCommerce plugin is accessible without authentication. You can test by sending a GET or POST request to the plugin's endpoint with a phone number parameter. For example, use curl: curl -X POST 'https://your-site.com/wp-json/shopsmart/v1/check_phone' -d 'phone=1234567890'. If the response includes sensitive customer data without authentication, the vulnerability is present.

Useful 0 Not Useful 0

Impact Analysis

Attackers can retrieve sensitive customer data such as names, emails, and account balances by simply knowing a phone number. This could lead to privacy breaches, identity theft, or misuse of customer information.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability likely violates GDPR and other privacy regulations by exposing personal data without proper safeguards. It could result in legal penalties, loss of customer trust, and failure to meet compliance requirements for data protection.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately update the ShopSmart Loyalty for WooCommerce plugin to the latest version. If no update is available, disable the plugin until a patch is released. Additionally, review server logs for unauthorized access attempts to the 'shopsmart_check_phone' endpoint and restrict access to sensitive endpoints via web application firewall rules.

Useful 0 Not Useful 0