CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L
What the vulnerability does
Missing Authorization vulnerability in Rymera Web Co Wholesale Suite – WooCommerce Wholesale Prices, B2B, Catalog Mode, Order Form, Wholesale User Roles, Dynamic Pricing & More.This issue affects Wholesale Suite – WooCommerce Wholesale Prices, B2B, Catalog Mode, Order Form, Wholesale User Roles, Dynamic Pricing & More: from n/a through 2.1.5.
Explanation of Vulnerability in Simple Terms
The Wholesale Suite plugin for WooCommerce does not properly check user permissions before allowing certain actions. A logged-in user with low privileges can modify data or disrupt site operations that should be restricted to administrators or specific roles. The vulnerability affects versions up to 2.1.5.
What an attacker can do
A low-privilege logged-in user can modify restricted data or disrupt site operations.
Potential impact on your site
Unauthorized users may alter wholesale pricing, catalog settings, or order data, affecting business logic and customer experience.
Conditions required to exploit
Attacker must have a low-privilege account on the site (e.g., customer or subscriber role).
Key dates
External resources
Related vulnerabilities
