CVE-2022-23981 MEDIUM

CVE-2022-23981: WordPress Perfect Brands for WooCommerce plugin <= 2.0.4 - Set Featured Brand vulnerability

Vendor Quadlayers
Product Perfect Brands for WooCommerce (WordPress plugin)
Weakness CWE-284
Published February 18, 2022
Last update April 28, 2026
View on NVD All CVEs

CVSS base score

4.3/10
Attack vector Network
Attack complexity Low
Privileges required Low
User interaction None
Confidentiality None
Integrity Low

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

What the vulnerability does

01Description

The vulnerability allows Subscriber+ level users to create brands in WordPress Perfect Brands for WooCommerce plugin (versions <= 2.0.4).

Explanation of Vulnerability in Simple Terms

02Summary

The Perfect Brands for WooCommerce plugin for WordPress contains an access control flaw that allows authenticated users with low privileges to modify data they should not have access to. The vulnerability affects versions up to and including 2.0.4. An attacker with a basic WordPress user account can alter plugin settings or data without proper authorization checks. Site owners should update to a version newer than 2.0.4.

What an attacker can do

03Attacker Capabilities

Modify plugin settings or data without proper authorization as a low-privilege user.

Potential impact on your site

04Site Impact

Unauthorized users can alter plugin configuration or brand data, potentially disrupting store functionality or data integrity.

Conditions required to exploit

05Prerequisites

Attacker must have a valid WordPress user account with low privileges; no user interaction required.

Key dates

06Disclosure timeline

February 18, 2022 CVE published
April 28, 2026 Record updated

Related vulnerabilities

08Related CVE

CVE-2026-64793 Joomla Extension - regularlabs.com - Content access and publication bypass in Articles Anywhere and Modules Anywhere extensions CVE-2026-65758 Joomla Extension - tassos.gr - Sensitive data exposure in Convert Forms extension 2.5.0-5.2.2 CVE-2025-14977 Dokan: AI Powered WooCommerce Multivendor Marketplace Solution – Build Your Own Amazon, eBay, Etsy <= 4.2.4 - Insecure Direct Object Reference to PayPal Account Takeover and Sensitive Information Disclosure CVE-2024-13430 Page Builder: Pagelayer – Drag and Drop website builder <= 1.9.8 - Authenticated (Contributor+) Private Post Disclosure in pagelayer_builder_posts_shortcode CVE-2025-12884 Advanced Ads – Ad Manager & AdSense <= 2.0.14 - Missing Authorization to Authenticated (Subscriber+) Ad Placements Update