CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
What the vulnerability does
The WPCS – WordPress Currency Switcher Professional plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the save function in versions up to, and including, 1.1.9. This makes it possible for authenticated attackers, with subscriber-level permissions and above, to edit an arbitrary custom drop-down currency switcher.
Explanation of Vulnerability in Simple Terms
The WPCS – WordPress Currency Switcher Professional plugin through version 1.1.9 lacks proper authorization checks on certain administrative functions. A logged-in user with low privileges can modify plugin settings or data without the required permissions. This affects the integrity of currency configuration and site behavior.
What an attacker can do
A low-privilege logged-in user can modify plugin settings or configuration without proper authorization.
Potential impact on your site
Unauthorized users can alter currency switcher settings, potentially disrupting pricing displays or site functionality for customers.
Conditions required to exploit
Attacker must have a valid WordPress user account with at least low-level privileges (e.g., subscriber or contributor role).
Key dates
External resources
Related vulnerabilities
