CVE-2015-3302 EXPLOIT
7.5
HIGH · CVSS 3.0 · EPSS 21.8% (pctl 98)
Patch early
A public exploit exists.
Description
The TheCartPress eCommerce Shopping Cart (aka The Professional WordPress eCommerce Plugin) plugin for WordPress before 1.3.9.3 allows remote attackers to obtain sensitive order detail information by leveraging a "broken authentication mechanism."
Scoring
| CVSS | 7.5 (HIGH, v3.0) |
|---|---|
| Vector | CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N |
| EPSS | 21.84% — more likely to be exploited than 98% of all CVEs |
| Weakness | CWE-284 |
| On CISA KEV | no |
| Public exploit | yes |
| Published | 2017-12-29 |
| Last modified | 2026-06-17 |
Affected (1)
| Vendor | Product |
|---|---|
| thecartpress | thecartpress ecommerce shopping cart |
Public exploits
| Source | Title | Date |
|---|---|---|
| exploit-db | WordPress Plugin TheCartPress 1.3.9 - Multiple Vulnerabilities | 2015-04-29 |
References
- http://packetstormsecurity.com/files/131673/WordPress-TheCartPress-1.3.9-XSS-Local-File-Inclusion.html
- http://www.securityfocus.com/archive/1/535396/100/1100/threaded
- http://www.securityfocus.com/bid/74395
- https://www.exploit-db.com/exploits/36860/
- https://www.htbridge.com/advisory/HTB23254
- http://packetstormsecurity.com/files/131673/WordPress-TheCartPress-1.3.9-XSS-Local-File-Inclusion.html
- http://www.securityfocus.com/archive/1/535396/100/1100/threaded
- http://www.securityfocus.com/bid/74395
- https://www.exploit-db.com/exploits/36860/
- https://www.htbridge.com/advisory/HTB23254
→ the Explorer · watch your stack · NVD