CVE-2024-13558: NP Quote Request for WooCommerce <= 1.9.179 - Insecure Direct Object Reference to Unauthenticated Sensitive Information Disclosure

7.5 CVSS

Description

The NP Quote Request for WooCommerce plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.9.179 due to missing validation on a user controlled key. This makes it possible for unauthenticated attackers to read the content of quote requests.

Classification

CVE ID: CVE-2024-13558

CVSS Base Severity: HIGH

CVSS Base Score: 7.5

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Problem Types

CWE-639 Authorization Bypass Through User-Controlled Key

Affected Products

Vendor: gplsaver

Product: NP Quote Request for WooCommerce

Exploit Prediction Scoring System (EPSS)

EPSS Score: 0.04% (probability of being exploited)

EPSS Percentile: 10.9% (scored less or equal to compared to others)

EPSS Date: 2025-04-18 (when was this score calculated)

References

https://nvd.nist.gov/vuln/detail/CVE-2024-13558
https://www.wordfence.com/threat-intel/vulnerabilities/id/5991c86b-6785-41a6-a5df-c65e8a28201c?source=cve
https://wordpress.org/plugins/woo-rfq-for-woocommerce/#developers
https://plugins.trac.wordpress.org/changeset/3256816/

Timeline