Users can see orders from other users!

  • Hey I’m having a pretty serious privacy issue with Ultimate Member on my site. A user recently notified me that from his user panel he can see not only his order but also a previous order that someone else had made that shows their Name, Address etc.
    I tested it by creating a new account and making an order and I too could see see the order I made as well as an order by a completely different customer.
    Ultimate member is up to date. I have no idea how to fix this and I don’t want to deactivate UM and have people lose all their account information.
    Please help!!! Thank you

Viewing 5 replies - 1 through 5 (of 5 total)
  • Plugin Contributor Champ Camba

    (@champsupertramp)

    Hi @dwellness

    Do you have a UM WooCommerce extension installed on your site? IF so, could you please contact us via our website as we cannot provide support for premium plugins in the free support forum: https://www.ultimatemember.com/support/

    Regards,

    Thread Starter dwellness

    (@dwellness)

    No I don’t have that extension installed.

    Plugin Contributor Champ Camba

    (@champsupertramp)

    Hi @dwellness

    Could you please provide a screenshot of the page where the “Orders” are located?

    Regards,

    Thread Starter dwellness

    (@dwellness)


    The top order is a test order I made and the order below is an actual order from a different person.

    Thread Starter dwellness

    (@dwellness)

    I’ve tried making more test accounts and each account can see another persons order. It seems at random. Its a real privacy issue as they can see other peoples orders, their name and address, email, phone etc. I’d like to continue using Ultimate Member but I’ll need to deactivate it if I can’t resolve it. I’m concerned that Ultimate Member is not a safe way to handle user data.

Viewing 5 replies - 1 through 5 (of 5 total)
  • The topic ‘Users can see orders from other users!’ is closed to new replies.