CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
What the vulnerability does
Missing Authorization vulnerability in Lauri Karisola / WP Trio Stock Sync for WooCommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Stock Sync for WooCommerce: from n/a through 2.3.2.
Explanation of Vulnerability in Simple Terms
Stock Sync for WooCommerce versions up to 2.3.2 lack proper authorization checks, allowing authenticated users with low privileges to access sensitive information they should not be able to view. An attacker with a basic WordPress account can read data that should be restricted to administrators or higher-privileged roles. The vulnerability does not allow data modification or system disruption, but exposes confidential information.
What an attacker can do
Read sensitive data restricted to higher-privileged users.
Potential impact on your site
Confidential business or customer data may be exposed to low-privilege users or compromised accounts.
Conditions required to exploit
Attacker must have a low-privilege WordPress user account (e.g., subscriber or contributor).
Key dates
External resources
Related vulnerabilities
