CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
What the vulnerability does
The WooCommerce Multiple Free Gift plugin for WordPress is vulnerable to gift manipulation in all versions up to, and including, 1.2.3. This is due to plugin not enforcing server-side checks on the products that can be added as a gift. This makes it possible for unauthenticated attackers to add non-gift items to their cart as a gift.
Explanation of Vulnerability in Simple Terms
WooCommerce Multiple Free Gift versions 1.2.3 and earlier contain an authorization flaw that allows unauthenticated attackers to modify gift settings over the network. The vulnerability requires no user interaction and affects the integrity of gift configurations. Site administrators should update to a version newer than 1.2.3 to prevent unauthorized changes to promotional gift rules.
What an attacker can do
Modify WooCommerce gift settings without authentication.
Potential impact on your site
Attackers can alter free gift promotions and rules without your knowledge or permission.
Conditions required to exploit
Network access only; no authentication or user interaction required.
Key dates
External resources
Related vulnerabilities
