CVE-2025-5816 Information

Jul 19, 2025 cve

Description

The Plugin Pengiriman WooCommerce Kurir Reguler Instan Kargo – Biteship plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to and including 3.2.0 via the get_order_detail() due to missing validation on a user controlled key. This makes it possible for authenticated attackers with Subscriber-level access and above to view other user’s orders.

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Reference

https://plugins.trac.wordpress.org/browser/biteship/trunk/includes/class-biteship.php#L515 https://plugins.trac.wordpress.org/browser/biteship/trunk/public/class-biteship-public.php#L327 https://www.wordfence.com/threat-intel/vulnerabilities/id/48509d43-57bb-452c-b39b-905354a273f3?source=cve

Attack Complexity

LOW

Privileges Required

LOW

User Interaction Required

LOW

Scope

NONE

Confidentiality Impact

UNCHANGED

Integrity Impact

LOW

Availability Impact

NONE

Base Score

NONE

Base Severity

4.3

CNNVD-202507-2403 (Published: 2025-07-18)

Share on: