CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
What the vulnerability does
The ELEX WooCommerce Dynamic Pricing and Discounts plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the elex_dp_export_rules() and elex_dp_import_rules() functions in all versions up to, and including, 2.1.7. This makes it possible for unauthenticated attackers to import and export product rules along with obtaining phpinfo() data
Explanation of Vulnerability in Simple Terms
The ELEX WooCommerce Dynamic Pricing and Discounts plugin through version 2.1.7 lacks proper authorization checks on certain functions. An unauthenticated attacker can read and modify pricing and discount data without permission. This affects all sites running the vulnerable version. Update to a version newer than 2.1.7 to resolve the issue.
What an attacker can do
Read and modify pricing and discount settings without authentication.
Potential impact on your site
Attackers can alter product prices and discounts, potentially causing revenue loss or customer confusion.
Conditions required to exploit
Network access to the site; no authentication or user interaction required.
Key dates
External resources
Related vulnerabilities
