CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
What the vulnerability does
The Product Input Fields for WooCommerce plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on the handle_downloads() function in versions up to, and including, 1.2.6. This makes it possible for unauthenticated attackers to download files from the vulnerable service.
Explanation of Vulnerability in Simple Terms
Product Input Fields for WooCommerce versions up to 1.2.6 expose sensitive data without proper access controls. An unauthenticated attacker can read information that should be restricted, such as customer data or configuration details. The vulnerability requires no user interaction and can be exploited remotely. Update to a version newer than 1.2.6 to resolve this issue.
What an attacker can do
Read sensitive data from the plugin without authentication, such as customer information or configuration details.
Potential impact on your site
Customer data and plugin configuration may be exposed to anyone on the internet without needing to log in.
Conditions required to exploit
Network access to the WooCommerce site; no authentication or user interaction required.
Key dates
External resources
Related vulnerabilities
