Shiprocket WordPress Plugin Authorization Bypass Vulnerability Allowing Insecure Direct Object References

A vulnerability allowing authorization bypass through user-controlled keys has been identified in the Shiprocket WordPress plugin, specifically in versions through 2.0.8. This issue arises from incorrectly configured access control security levels, which could be exploited to bypass authorization and access sensitive resources.

Impact

Exploitation of this vulnerability could lead to unauthorized access to sensitive files or database interactions, allowing for potential data manipulation or exposure.

Remediation

Users are advised to update to a version of the Shiprocket WordPress plugin later than 2.0.8. For those using Patchstack, a mitigation rule is available to block attacks until an official patch can be safely applied.