CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
What the vulnerability does
The WooCommerce Multivendor Marketplace – REST API plugin for WordPress is vulnerable to unauthorized access of data and addition of data due to a missing capability check on the 'get_item', 'get_order_notes' and 'add_order_note' functions in versions up to, and including, 1.5.3. This makes it possible for authenticated attackers with subscriber privileges or above, to view the order details and order notes, and add order notes.
Explanation of Vulnerability in Simple Terms
WCFM Multivendor Marketplace for WooCommerce versions up to 1.5.3 lack proper authorization checks in the REST API. An authenticated user with low privileges can trigger a denial-of-service condition by making specific API requests. The vulnerability does not allow data theft or modification, but can disrupt site availability.
What an attacker can do
Make the site temporarily unavailable or unresponsive by sending crafted API requests.
Potential impact on your site
Site availability may be disrupted; legitimate users may experience slowdowns or timeouts until the attack stops.
Conditions required to exploit
Attacker must have a valid user account with low-level permissions (e.g., customer or vendor account).
Key dates
External resources
Related vulnerabilities
