Find a vulnerability

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-5816",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-07-18T13:53:35.761080Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-07-18T13:53:42.530Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Plugin Pengiriman WooCommerce Kurir Reguler, Instan, Kargo \u2013 Biteship",
          "vendor": "biteship",
          "versions": [
            {
              "lessThanOrEqual": "3.2.0",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "ch4r0n"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The Plugin Pengiriman WooCommerce Kurir Reguler, Instan, Kargo \u2013 Biteship plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 3.2.0 via the get_order_detail() due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with Subscriber-level access and above, to view other user\u0027s orders."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 4.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-862",
              "description": "CWE-862 Missing Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-04-08T16:50:10.527Z",
        "orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
        "shortName": "Wordfence"
      },
      "references": [
        {
          "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/48509d43-57bb-452c-b39b-905354a273f3?source=cve"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/biteship/trunk/public/class-biteship-public.php#L327"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/biteship/trunk/includes/class-biteship.php#L515"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2025-07-17T16:22:18.000Z",
          "value": "Disclosed"
        }
      ],
      "title": "Plugin Pengiriman WooCommerce Kurir Reguler, Instan, Kargo \u2013 Biteship \u003c= 3.2.0 - Insecure Direct Object Reference to Authenticated (Subscriber+) View Order Tracking Details"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
    "assignerShortName": "Wordfence",
    "cveId": "CVE-2025-5816",
    "datePublished": "2025-07-18T04:23:01.362Z",
    "dateReserved": "2025-06-06T16:32:21.917Z",
    "dateUpdated": "2026-04-08T16:50:10.527Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}