CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
What the vulnerability does
The BuddyPress WooCommerce My Account Integration. Create WooCommerce Member Pages plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the wc4bp_delete_page() function in all versions up to, and including, 3.4.24. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update the plugins page setting.
Explanation of Vulnerability in Simple Terms
The BuddyPress WooCommerce My Account Integration plugin for WordPress does not properly check user permissions before allowing certain actions. A logged-in user with low privileges can modify data they should not have access to. The vulnerability affects versions up to 3.4.24.
What an attacker can do
A logged-in user can modify data or settings they should not have permission to change.
Potential impact on your site
Unauthorized users may alter WooCommerce member pages or account settings, potentially disrupting customer experience or exposing sensitive data.
Conditions required to exploit
Attacker must have a low-privilege WordPress user account (e.g., subscriber or customer role).
Key dates
External resources
Related vulnerabilities
