CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
What the vulnerability does
The Ni Sales Commission For WooCommerce plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the 'niwoosc_ajax' AJAX endpoint in all versions up to, and including, 1.2.4. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update the plugins settings and modify commission amounts.
Explanation of Vulnerability in Simple Terms
Ni Sales Commission For WooCommerce versions up to 1.2.4 lack proper authorization checks, allowing authenticated users with low privileges to modify commission data they should not have access to. The vulnerability requires a valid WordPress account but no special permissions. Site administrators should update to a version newer than 1.2.4 to prevent unauthorized commission record tampering.
What an attacker can do
Modify commission records or settings without proper authorization.
Potential impact on your site
Commission data integrity compromised; low-privilege users can alter sales commission records.
Conditions required to exploit
Attacker must have a low-privilege WordPress user account (e.g., subscriber or contributor).
Key dates
External resources
