CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
What the vulnerability does
The WooCommerce Google Sheet Connector plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the execute_post_data function in all versions up to, and including, 1.3.11. This makes it possible for unauthenticated attackers to update plugin settings.
Explanation of Vulnerability in Simple Terms
GSheetConnector for WooCommerce versions up to 1.3.11 lack proper authorization checks, allowing unauthenticated attackers to modify data sent to Google Sheets. An attacker can intercept or alter order and product information without needing valid credentials. Update to a version newer than 1.3.11 to restore access controls.
What an attacker can do
Modify order and product data sent to Google Sheets without authentication.
Potential impact on your site
Customer orders and product information synced to Google Sheets can be altered by unauthorized parties.
Conditions required to exploit
Network access to the plugin endpoint; no authentication or user interaction required.
Key dates
External resources
Related vulnerabilities
