What the vulnerability does
01Description
The License Manager for WooCommerce plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the showLicenseKey() and showAllLicenseKeys() functions in all versions up to, and including, 3.0.6. This makes it possible for authenticated attackers, with admin dashboard access (contributors by default due to WooCommerce) to view arbitrary decrypted license keys. The functions contain a referrer nonce check. However, these can be retrieved via the dashboard through the "license" JS variable. Please note that the version in trunk is patched, however, the 3.0.7 tagged version is not.
Explanation of Vulnerability in Simple Terms
02Summary
License Manager for WooCommerce versions 3.0.6 and earlier lack proper authorization checks, allowing authenticated users with low privileges to read sensitive data they should not access. An attacker with a basic user account can retrieve confidential information without additional interaction. This affects the plugin's core access control logic.
What an attacker can do
03Attacker Capabilities
Read sensitive data (like license keys or customer information) that should be restricted to higher-privilege users.
Potential impact on your site
04Site Impact
Customer data, license information, or other confidential records may be exposed to any registered user, risking privacy violations and data leaks.
Conditions required to exploit
05Prerequisites
Attacker must have a low-privilege user account on the WooCommerce site (e.g., customer or subscriber role).
Key dates
06Disclosure timeline
June 21, 2024
CVE published
April 8, 2026
Record updated
