CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
What the vulnerability does
The WPCS – WordPress Currency Switcher Professional plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the anonymous function for the wpcs_sd_delete action in versions up to, and including, 1.1.9. This makes it possible for authenticated attackers, with subscriber-level permissions and above, to delete an arbitrary custom drop-down currency switcher.
Explanation of Vulnerability in Simple Terms
The WPCS – WordPress Currency Switcher Professional plugin through version 1.1.9 lacks proper authorization checks on certain functions. A logged-in user with low privileges can modify plugin settings or data without proper permission validation. This allows unauthorized changes to currency switching behavior or configuration that should be restricted to administrators.
What an attacker can do
Modify plugin settings or data without admin permission.
Potential impact on your site
Unauthorized users can alter currency switcher configuration, potentially disrupting store functionality or customer experience.
Conditions required to exploit
Attacker must be logged in as a low-privilege user (subscriber or contributor).
Key dates
External resources
Related vulnerabilities
