CVE-2023-5132
Soisy Pagamento Rateale <= 6.0.1 - Missing Authorization to Sensitive Information Exposure
CVSS Score
7.5
EPSS Score
0.0%
EPSS Percentile
0th
The Soisy Pagamento Rateale plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the parseRemoteRequest function in versions up to, and including, 6.0.1. This makes it possible for unauthenticated attackers with knowledge of an existing WooCommerce Order ID to expose sensitive WooCommerce order information (e.g., Name, Address, Email Address, and other order metadata).
| CWE | CWE-862 |
| Vendor | soisytech |
| Product | soisy pagamento rateale |
| Published | Oct 21, 2023 |
| Last Updated | Apr 8, 2026 |
Stay Ahead of the Next One
Get instant alerts for soisytech soisy pagamento rateale
Be the first to know when new high vulnerabilities affecting soisytech soisy pagamento rateale are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality
Integrity
Availability
Affected Versions
soisytech / Soisy Pagamento Rateale
0 ≤ 6.0.1
References
wordfence.com: https://www.wordfence.com/threat-intel/vulnerabilities/id/d3c997cd-37b4-4b9c-b99e-397be484aa36?source=cve plugins.trac.wordpress.org: https://plugins.trac.wordpress.org/browser/soisy-pagamento-rateale/trunk/public/class-soisy-pagamento-rateale-public.php#L465 plugins.trac.wordpress.org: https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2979568%40soisy-pagamento-rateale&new=2979568%40soisy-pagamento-rateale&sfp_email=&sfph_mail=
Credits
Francesco Carlucci