CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
What the vulnerability does
The YITH WooCommerce Gift Cards plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'save_mail_status' and 'save_email_settings' functions in all versions up to, and including, 4.12.0. This makes it possible for unauthenticated attackers to modify WooCommerce settings.
Explanation of Vulnerability in Simple Terms
YITH WooCommerce Gift Cards versions up to 4.12.0 contain an improper access control vulnerability that allows unauthenticated attackers to modify gift card data over the network. The vulnerability requires no user interaction and can be exploited remotely. Site administrators should update to a version newer than 4.12.0 to prevent unauthorized gift card manipulation.
What an attacker can do
Modify gift card data without authentication, such as balance or recipient information.
Potential impact on your site
Gift card values, balances, or recipient details could be altered by attackers, causing financial loss or customer disputes.
Conditions required to exploit
Network access only; no authentication or user interaction required.
Key dates
External resources
Related vulnerabilities
