CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
What the vulnerability does
The TI WooCommerce Wishlist plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'wizard' function in all versions up to, and including, 2.9.1. This makes it possible for unauthenticated attackers to create new pages, modify plugin settings, and perform limited options updates.
Explanation of Vulnerability in Simple Terms
The TI WooCommerce Wishlist plugin through version 2.9.1 lacks proper authorization checks on certain functions. An unauthenticated attacker can modify wishlist data without permission. This affects all installations running the vulnerable version. Update to a version newer than 2.9.1 to resolve the issue.
What an attacker can do
Modify or delete wishlist data belonging to other users without authentication.
Potential impact on your site
Wishlist data can be corrupted or deleted by unauthorized parties, damaging user experience and trust.
Conditions required to exploit
Network access to the WordPress site; no authentication or user interaction required.
Key dates
External resources
Related vulnerabilities
