5.3

CVE-2024-0617

Category Discount Woocommerce <= 4.12 - Missing Authorization via wpcd_save_discount()

Category Discount Woocommerce <= 4.11 - Cross-Site Request Forgery via wpcd_save_discount()

The Category Discount Woocommerce plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the wpcd_save_discount() function in all versions up to, and including, 4.12. This makes it possible for unauthenticated attackers to modify product category discounts that could lead to loss of revenue.
Mögliche Gegenmaßnahme
Simple Discount Rules for Woocommerce: Update to version 4.13, or a newer patched version
Simple Discount Rules for Woocommerce: Update to version 4.12, or a newer patched version
Weitere Schwachstelleninformationen
SystemWordPress Plugin
≫
Produkt Simple Discount Rules for Woocommerce
Version *-4.12
SystemWordPress Plugin
≫
Produkt Simple Discount Rules for Woocommerce
Version *-4.11
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Quanticedgesolutions ≫ Category Discount Woocommerce SwPlatformwordpress Version < 4.13
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.13% 0.334
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 5.3 3.9 1.4
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
security@wordfence.com 5.3 3.9 1.4
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
CWE-862 Missing Authorization

The product does not perform an authorization check when an actor attempts to access a resource or perform an action.