CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
What the vulnerability does
The Discount Rules for WooCommerce plugin for WordPress is vulnerable to missing authorization via several AJAX actions in versions up to, and including, 2.0.2 due to missing capability checks on various functions. This makes it possible for subscriber-level attackers to execute various actions and perform a wide variety of actions such as modifying rules and saving configurations.
Explanation of Vulnerability in Simple Terms
The Discount Rules for WooCommerce plugin through version 2.0.2 lacks proper authorization checks on certain administrative functions. A logged-in user with low privileges can read, modify, or delete discount rules without proper permission validation. This allows unauthorized access to sensitive pricing and promotion data that should be restricted to administrators.
What an attacker can do
Read, modify, or delete discount rules without proper authorization.
Potential impact on your site
Unauthorized users can tamper with discount rules, potentially disrupting pricing, promotions, and revenue.
Conditions required to exploit
Attacker must have a low-privilege user account on the site (e.g., customer or subscriber role).
Key dates
External resources
Related vulnerabilities
