CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
What the vulnerability does
Missing Authorization vulnerability in Bizswoop Account Manager for WooCommerce allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Account Manager for WooCommerce: from n/a through 2.1.2.
Explanation of Vulnerability in Simple Terms
Account Manager for WooCommerce versions up to 2.1.2 lack proper authorization checks on certain functions. A logged-in user with low privileges can access or modify data they should not have permission to view or change. The vulnerability requires an active user account but no special interaction from the victim.
What an attacker can do
Read or modify data belonging to other users or restricted account information.
Potential impact on your site
Customer or staff accounts may have their data exposed or altered by other authenticated users.
Conditions required to exploit
Attacker must have a valid WooCommerce user account with low-level privileges.
Key dates
External resources
Related vulnerabilities
