CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
What the vulnerability does
The Thank You Page Customizer for WooCommerce – Increase Your Sales plugin for WordPress is vulnerable to missing authorization e in all versions up to, and including, 1.1.2 via the apply_layout function due to a missing capability check. This makes it possible for authenticated attackers, with subscriber-level access and above, to retrieve arbitrary order data which may contain PII.
Explanation of Vulnerability in Simple Terms
The Thank You Page Customizer for WooCommerce plugin through version 1.1.2 does not properly check user permissions before allowing access to certain administrative functions. A logged-in user with low privileges can view sensitive configuration data that should be restricted to site administrators. The vulnerability requires an active user account but no special interaction.
What an attacker can do
Read sensitive plugin configuration and settings intended only for administrators.
Potential impact on your site
Customer or subscriber accounts can access admin-level plugin settings and potentially sensitive WooCommerce configuration data.
Conditions required to exploit
Attacker must have a low-privilege user account (e.g., subscriber or customer) on the WordPress site.
Key dates
External resources
Related vulnerabilities
