CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
What the vulnerability does
The ECPay Ecommerce for WooCommerce plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the 'clear_ecpay_debug_log' AJAX action in all versions up to, and including, 1.1.2411060. This makes it possible for authenticated attackers, with Subscriber-level access and above, to clear the plugin's log files.
Explanation of Vulnerability in Simple Terms
ECPay Ecommerce for WooCommerce versions up to 1.1.2411060 lack proper authorization checks, allowing authenticated users to modify data they should not have access to. An attacker with a low-privilege account can alter payment or order information without proper permission validation. The vulnerability affects the plugin's core functionality and requires a valid user login to exploit.
What an attacker can do
Modify payment or order data without proper authorization as an authenticated user.
Potential impact on your site
Unauthorized users can tamper with orders, payments, or related data, risking financial loss and data integrity.
Conditions required to exploit
Attacker must have a valid WooCommerce user account with low-level privileges.
Key dates
External resources
Related vulnerabilities
