CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
What the vulnerability does
The Thank You Page Customizer for WooCommerce – Increase Your Sales plugin for WordPress is vulnerable to unauthorized execution of shortcodes due to a missing capability check on the get_text_editor_content() function in all versions up to, and including, 1.1.2. This makes it possible for authenticated attackers, with subscriber-level access and above, to execute arbitrary shortcodes.
Explanation of Vulnerability in Simple Terms
The Thank You Page Customizer for WooCommerce plugin through version 1.1.2 lacks proper authorization checks on certain administrative functions. A logged-in user with low privileges can modify plugin settings and access sensitive configuration data without the required permissions. This allows unauthorized changes to thank-you page content and potentially exposes store configuration details.
What an attacker can do
Modify plugin settings and access configuration data without proper authorization.
Potential impact on your site
Unauthorized users can alter thank-you page content and potentially access sensitive WooCommerce configuration.
Conditions required to exploit
Attacker must be logged in to WordPress with a low-privilege account (e.g., subscriber or contributor).
Key dates
External resources
Related vulnerabilities
