CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L
What the vulnerability does
The Product Sort and Display for WooCommerce plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the psad_update_product_cat_custom_meta_ajax function in all versions up to, and including, 2.4.1. This makes it possible for unauthenticated attackers to hide product categories.
Explanation of Vulnerability in Simple Terms
The Product Sort and Display for WooCommerce plugin through version 2.4.1 lacks proper authorization checks, allowing unauthenticated attackers to modify product data and availability. An attacker can change product information and disable products without needing to log in or interact with a site administrator. This affects all installations running the vulnerable version.
What an attacker can do
Modify or disable WooCommerce products without authentication.
Potential impact on your site
Attackers can alter product listings, prices, and availability, disrupting store operations and customer experience.
Conditions required to exploit
Network access to the site; no authentication or user interaction required.
Key dates
External resources
Related vulnerabilities
