CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
What the vulnerability does
The Zass - WooCommerce Theme for Handmade Artists and Artisans theme for WordPress is vulnerable to unauthorized access due to a missing capability check on the 'zass_import_zass' AJAX actions in all versions up to, and including, 3.9.9.10. This makes it possible for authenticated attackers, with Subscriber-level access and above, to import demo content and overwrite the site.
Explanation of Vulnerability in Simple Terms
The Zass WooCommerce theme for handmade artists contains an authorization flaw that allows authenticated users to modify data they should not have access to. An attacker with a low-privilege account can change information without proper permission checks. The vulnerability affects all versions up to 3.9.9.10. Site owners should update to a patched version when available.
What an attacker can do
Modify data or settings they should not have permission to change.
Potential impact on your site
Unauthorized users can alter site content, product data, or settings depending on what the theme exposes.
Conditions required to exploit
Attacker must have a low-privilege account on the site (e.g., customer or contributor role).
Key dates
External resources
Related vulnerabilities
