7.2
CVE-2024-9927
- EPSS 0.16%
- Veröffentlicht 23.10.2024 02:15:07
- Zuletzt bearbeitet 25.10.2024 16:29:27
- Quelle security@wordfence.com
- Teams Watchlist Login
- Unerledigt Login
The WooCommerce Order Proposal plugin for WordPress is vulnerable to privilege escalation via order proposal in all versions up to and including 2.0.5. This is due to the improper implementation of allow_payment_without_login function. This makes it possible for authenticated attackers, with Shop Manager-level access and above, to log in to WordPress as an arbitrary user account, including administrators.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Wpovernight ≫ Woocommerce Order Proposal SwPlatformwordpress Version < 2.0.6
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
| Typ | Quelle | Score | Percentile |
|---|---|---|---|
| EPSS | FIRST.org | 0.16% | 0.378 |
| Quelle | Base Score | Exploit Score | Impact Score | Vector String |
|---|---|---|---|---|
| security@wordfence.com | 7.2 | 1.2 | 5.9 |
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
|
CWE-287 Improper Authentication
When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.