CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
What the vulnerability does
The TI WooCommerce Wishlist and TI WooCommerce Wishlist Pro plugins for WordPress are vulnerable to an Options Change vulnerability in versions up to, and including, 1.21.11 and 1.21.4 via the 'ti-woocommerce-wishlist/includes/export.class.php' file. This makes it possible for authenticated attackers to gain otherwise restricted access to the vulnerable blog and update any settings.
Explanation of Vulnerability in Simple Terms
TI WooCommerce Wishlist Pro versions up to 1.21.4 lack proper authorization checks, allowing authenticated users to read, modify, or delete data they should not access. An attacker with a low-privilege account can escalate their capabilities within the plugin without additional interaction. This affects all data the plugin manages, including wishlist information and potentially customer records.
What an attacker can do
Read, modify, or delete wishlist data and other plugin information belonging to other users or the site.
Potential impact on your site
Customer wishlist data and plugin functionality can be compromised by any registered user, risking data loss and customer trust.
Conditions required to exploit
Attacker must have a low-privilege user account on the WordPress site (e.g., subscriber or customer role).
Key dates
External resources
Related vulnerabilities
