{"id":"CVE-2023-0865","aliases":["EUVD-2023-12862","GHSA-vrv9-62rj-7748"],"status":"published","title":"WooCommerce Multiple Customer Addresses \u0026 Shipping \u003c 21.7 - Arbitrary Address Creation/Deletion/Access/Update via IDOR","description":"The WooCommerce Multiple Customer Addresses \u0026 Shipping WordPress plugin before 21.7 does not ensure that the address to add/update/retrieve/delete and duplicate belong to the user making the request, or is from a high privilege users, allowing any authenticated users, such as subscriber to add/update/duplicate/delete as well as retrieve addresses of other users.","severity":{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-11","score":0.01196,"percentile":0.6849,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-639"],"published":"2023-03-20T15:52:15Z","modified":"2026-06-17T05:26:30Z","products":[{"vendor":"unknown","product":"woocommerce multiple customer addresses \u0026 shipping"},{"vendor":"woocommerce_multiple_customer_addresses_\\\u0026_shipping_project","product":"woocommerce_multiple_customer_addresses_\\\u0026_shipping"}],"references":[{"url":"https://wpscan.com/vulnerability/e39c0171-ed4a-4143-9a31-c407e3555eec","tags":["exploit","vdb-entry","technical-description","x_transferred","Exploit","Third Party Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-0865"},{"url":"https://github.com/advisories/GHSA-vrv9-62rj-7748"}],"sources":{"cve":[{"id":"CVE-2023-0865","title":"WooCommerce Multiple Customer Addresses \u0026 Shipping \u003c 21.7 - Arbitrary Address Creation/Deletion/Access/Update via IDOR","description":"The WooCommerce Multiple Customer Addresses \u0026 Shipping WordPress plugin before 21.7 does not ensure that the address to add/update/retrieve/delete and duplicate belong to the user making the request, or is from a high privilege users, allowing any authenticated users, such as subscriber to add/update/duplicate/delete as well as retrieve addresses of other users.","status":"published","published":"2023-03-20T15:52:15.223Z","modified":"2025-02-26T14:33:12.565Z","cwes":["CWE-639"],"updated_at":"2026-11-02T14:35:35.256261Z"}],"euvd":[{"id":"EUVD-2023-12862","description":"The WooCommerce Multiple Customer Addresses \u0026 Shipping WordPress plugin before 21.7 does not ensure that the address to add/update/retrieve/delete and duplicate belong to the user making the request, or is from a high privilege users, allowing any authenticated users, such as subscriber to add/update/duplicate/delete as well as retrieve addresses of other users.","status":"published","published":"2023-03-20T15:52:15Z","modified":"2025-02-26T14:33:12Z","cvss":[{"version":"","score":0,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"none"}],"updated_at":"2026-11-02T20:53:23.677257Z"}],"ghsa":[{"id":"GHSA-vrv9-62rj-7748","title":"The WooCommerce Multiple Customer Addresses \u0026 Shipping WordPress plugin before 21.7 does not...","description":"The WooCommerce Multiple Customer Addresses \u0026 Shipping WordPress plugin before 21.7 does not ensure that the address to add/update/retrieve/delete and duplicate belong to the user making the request, or is from a high privilege users, allowing any authenticated users, such as subscriber to add/update/duplicate/delete as well as retrieve addresses of other users.","status":"published","published":"2023-03-20T18:30:55Z","modified":"2023-03-31T05:06:57Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-639"],"updated_at":"2026-11-02T14:54:25.211321Z"}],"nvd":[{"id":"CVE-2023-0865","description":"The WooCommerce Multiple Customer Addresses \u0026 Shipping WordPress plugin before 21.7 does not ensure that the address to add/update/retrieve/delete and duplicate belong to the user making the request, or is from a high privilege users, allowing any authenticated users, such as subscriber to add/update/duplicate/delete as well as retrieve addresses of other users.","status":"published","published":"2023-03-20T16:15:12.507Z","modified":"2026-06-17T05:26:30.823Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"}],"cwes":["CWE-639"],"updated_at":"2026-11-02T14:07:49.031498Z"}]}}