CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
What the vulnerability does
Missing Authorization vulnerability in Woo WooCommerce Subscriptions allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WooCommerce Subscriptions: from n/a before 5.8.0.
Explanation of Vulnerability in Simple Terms
WooCommerce Subscriptions versions before 5.8.0 lack proper authorization checks, allowing authenticated users with low privileges to access subscription data they should not be able to view. An attacker with a standard user account can read sensitive subscription information belonging to other customers. Update to version 5.8.0 or later to resolve this issue.
What an attacker can do
Read other customers' subscription data and details without authorization.
Potential impact on your site
Customer subscription information may be exposed to other users; privacy and trust are at risk.
Conditions required to exploit
Attacker must have a valid low-privilege user account on the site (e.g., customer account).
Key dates
External resources
Related vulnerabilities
