CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
What the vulnerability does
The Customer Reviews for WooCommerce plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the cancel_import() function in all versions up to, and including, 5.61.0. This makes it possible for authenticated attackers, with Subscriber-level access and above, to cancel and import or check on the status.
Explanation of Vulnerability in Simple Terms
The Customer Reviews for WooCommerce plugin through version 5.61.0 lacks proper authorization checks, allowing authenticated users with low privileges to modify review data they should not have access to. An attacker with a basic user account can alter or tamper with customer reviews without proper permission validation. This affects the integrity of review content on WooCommerce sites.
What an attacker can do
Modify or tamper with customer reviews without proper authorization.
Potential impact on your site
Customer reviews can be altered by unauthorized users, compromising review authenticity and customer trust.
Conditions required to exploit
Attacker must have a low-privilege authenticated account on the site.
Key dates
External resources
Related vulnerabilities
