CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L
What the vulnerability does
Missing Authorization vulnerability in tychesoftwares Abandoned Cart Lite for WooCommerce woocommerce-abandoned-cart allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Abandoned Cart Lite for WooCommerce: from n/a through <= 5.16.1.
Explanation of Vulnerability in Simple Terms
The Abandoned Cart Lite for WooCommerce plugin through version 5.16.1 lacks proper authorization checks on certain administrative functions. A logged-in user with low privileges can modify or delete cart data and settings without proper permission validation. This affects the integrity of abandoned cart records and site configuration.
What an attacker can do
Modify or delete abandoned cart data and plugin settings without proper authorization.
Potential impact on your site
Abandoned cart records and plugin configuration can be altered or destroyed by unauthorized users, disrupting recovery campaigns.
Conditions required to exploit
Attacker must have a low-privilege WordPress user account (e.g., subscriber or contributor).
Key dates
External resources
Related vulnerabilities
