About security issues | ww.wp.xz.cn

Resolved sycherry
(@sycherry)

7 years, 3 months ago

Hello,
I have a question.
When I logged in and accessed the address below, I can see the information of other customers.
Just by rewriting the url order number.

example:)
UserA can access 2 and 3 links.
１.https://mysite/my-account/print-order/100/ order by User A
2.https://mysite/my-account/print-order/101/ order by User B
3.https://mysite/my-account/print-order/102/ order by User C

Is this a security problem?

Viewing 1 replies (of 1 total)

Plugin Support Upendra Kapse
(@wpupen)

7 years, 3 months ago

Hello,

I have just checked this issue on our end and I am guessing your User A who can see Invoices of User B and User C must be an Administrator user. Only a user with the Administrator role will be able to access all the Invoices this way.

A user with Customer role will only be able to access Invoices for the orders they have placed. Even if they try to change the order number in the URL they will not be able to access the other Invoices.

Please let me know if I have missed something here.

Regards,
Upendra.

Viewing 1 replies (of 1 total)

The topic ‘About security issues’ is closed to new replies.

1 reply
2 participants
Last reply from: Upendra Kapse
Last activity: 7 years, 3 months ago
Status: resolved