5.3

CVE-2024-0617

Category Discount Woocommerce <= 4.12 - Missing Authorization via wpcd_save_discount()

Category Discount Woocommerce <= 4.12 - Missing Authorization via wpcd_save_discount()

Category Discount Woocommerce <= 4.11 - Cross-Site Request Forgery via wpcd_save_discount()

The Category Discount Woocommerce plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the wpcd_save_discount() function in all versions up to, and including, 4.12. This makes it possible for unauthenticated attackers to modify product category discounts that could lead to loss of revenue.
Mögliche Gegenmaßnahme
Simple Discount Rules for Woocommerce: Update to version 4.13, or a newer patched version
Simple Discount Rules for Woocommerce: Update to version 4.12, or a newer patched version
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Quanticedgesolutions ≫ Category Discount Woocommerce SwPlatformwordpress Version < 4.13
Weitere Schwachstelleninformationen
SystemWordPress Plugin
≫
Produkt Simple Discount Rules for Woocommerce
Version *-4.12
SystemWordPress Plugin
≫
Produkt Simple Discount Rules for Woocommerce
Version *-4.11
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.49% 0.382
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 5.3 3.9 1.4
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
security@wordfence.com 5.3 3.9 1.4
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
CWE-862 Missing Authorization

The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

https://plugins.trac.wordpress.org/browser/woo-product-category-discount/trunk/cd-admin.php#L171
Product
https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3026242%40woo-product-category-discount&new=3026242%40woo-product-category-discount&sfp_email=&sfph_mail=
Patch
https://www.wordfence.com/threat-intel/vulnerabilities/id/996b44bb-d1e0-4f82-b8ee-a98b0ae994f9?source=cve
Third Party Advisory
https://www.wordfence.com/threat-intel/vulnerabilities/id/996b44bb-d1e0-4f82-b8ee-a98b0ae994f9
Third Party Advisory
https://www.wordfence.com/threat-intel/vulnerabilities/id/f04dee5b-d16f-4ef0-88a4-1567e2287bd5
Third Party Advisory