What the vulnerability does
01Description
Missing Authorization vulnerability in Woo WooCommerce Warranty Requests.This issue affects WooCommerce Warranty Requests: from n/a through 2.2.7.
CVE-2023-51495
MEDIUM
CVE-2023-51495: WordPress WooCommerce Warranty Requests plugin <= 2.2.7 - Broken Access Control vulnerability
CVSS base score
6.5/10
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L
Explanation of Vulnerability in Simple Terms
02Summary
WooCommerce Warranty Requests versions up to 2.2.7 lack proper authorization checks, allowing unauthenticated attackers to modify warranty request data over the network. An attacker can alter or delete warranty records without needing to log in or interact with a user. Site owners should update immediately to prevent data tampering and service disruption.
What an attacker can do
03Attacker Capabilities
Modify or delete warranty request records without authentication.
Potential impact on your site
04Site Impact
Warranty data can be altered or deleted by anyone, disrupting customer service and trust.
Conditions required to exploit
05Prerequisites
Network access only; no login or user interaction required.
Key dates
06Disclosure timeline
June 14, 2024
CVE published
April 28, 2026
Record updated
External resources
07References
Related vulnerabilities
08Related CVE
CVE-2026-57353 WordPress Link Whisper Premium plugin <= 2.9.0 - Broken Access Control vulnerability
CVE-2026-13459 JetFormBuilder <= 3.6.3 - Missing Authorization to Unauthenticated Sensitive Information Disclosure via 'context' Parameter
CVE-2026-12472 Kirki <= 6.0.11 - Missing Authorization to Unauthenticated Arbitrary Email Content Injection (Mail Relay / Phishing) via 'emailBody' and 'emailSubject' Parameters
CVE-2026-12432 Stripe Payment Forms by WP Full Pay <= 8.4.3 - Missing Authorization to Unauthenticated Payment Record Manipulation via 'paymentIntentId' Parameter
CVE-2025-69134 WordPress OpenAI Chatbot for WordPress – Helper plugin <= 1.1.4 - Arbitrary Content Deletion vulnerability
