CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
What the vulnerability does
The GoHero Store Customizer for WooCommerce plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the wooh_action_settings_save_frontend() function in all versions up to, and including, 3.5. This makes it possible for unauthenticated attackers to update limited plugin settings.
Explanation of Vulnerability in Simple Terms
The GoHero Store Customizer for WooCommerce plugin for WordPress contains a missing authorization flaw that allows authenticated users with low privileges to modify site data they should not have access to. An attacker with a basic user account can make unauthorized changes to store customization settings. The vulnerability affects versions 3.5 and earlier. Site owners should update to a version newer than 3.5 as soon as a patch becomes available.
What an attacker can do
Modify store customization settings without proper authorization.
Potential impact on your site
Unauthorized users can alter your store's appearance and customization settings, potentially damaging customer experience.
Conditions required to exploit
Attacker needs a low-privilege WordPress user account (e.g., subscriber or contributor).
Key dates
External resources
Related vulnerabilities
