What the vulnerability does
01Description
Missing Authorization vulnerability in WPXPO WowStore product-blocks allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WowStore: from n/a through <= 2.7.8.
CVE-2023-45271
MEDIUM
CVE-2023-45271: WordPress ProductX – Gutenberg WooCommerce Blocks plugin <= 2.7.8 - Broken Access Control vulnerability
CVSS base score
4.3/10
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
Explanation of Vulnerability in Simple Terms
02Summary
WowStore versions up to 2.7.8 lack proper authorization checks, allowing an attacker to modify data on the site if a user visits a malicious link. The vulnerability requires user interaction and does not affect data confidentiality or availability. Site administrators should update to a version newer than 2.7.8.
What an attacker can do
03Attacker Capabilities
Modify site data if a user clicks a malicious link.
Potential impact on your site
04Site Impact
Unauthorized changes to site content or settings if users are tricked into clicking malicious links.
Conditions required to exploit
05Prerequisites
No authentication required; victim must click attacker-supplied link.
Key dates
06Disclosure timeline
January 2, 2025
CVE published
April 29, 2026
Record updated
External resources
07References
Related vulnerabilities
08Related CVE
CVE-2026-27435 WordPress Woffice theme < 5.4.33 - Broken Access Control vulnerability
CVE-2026-12432 Stripe Payment Forms by WP Full Pay <= 8.4.3 - Missing Authorization to Unauthenticated Payment Record Manipulation via 'paymentIntentId' Parameter
CVE-2026-11912 Simple File List <= 6.3.7 - Missing Authorization to Unauthenticated File Modification via simplefilelist_edit_job AJAX Action
CVE-2026-57648 WordPress Nelio Content plugin <= 4.3.4 - Broken Access Control vulnerability
CVE-2026-9233 Quiz and Survey Master (QSM) <= 11.1.4 - Missing Authorization to Authenticated (Contributor+) Arbitrary Modification via qsm_insert_quiz_template AJAX Action
