CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
What the vulnerability does
Missing Authorization vulnerability in YummyWP Smart WooCommerce Search allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Smart WooCommerce Search: from n/a through 2.5.0.
Explanation of Vulnerability in Simple Terms
Smart WooCommerce Search through version 2.5.0 fails to properly check user permissions before allowing modifications to search settings. A logged-in user with low privileges can alter search configuration without authorization. The vulnerability affects data integrity but does not expose sensitive information or disrupt site availability.
What an attacker can do
A low-privilege logged-in user can modify search settings without proper authorization.
Potential impact on your site
Unauthorized users can change how your WooCommerce search behaves, potentially degrading search quality or hiding products.
Conditions required to exploit
Attacker must have a low-privilege account on the site (e.g., subscriber or contributor role).
Key dates
External resources
Related vulnerabilities
