CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
What the vulnerability does
The WooCommerce Add to Cart Custom Redirect plugin for WordPress is vulnerable to unauthorized modification of data and loss of data due to a missing capability check on the 'wcr_dismiss_admin_notice' function in all versions up to, and including, 1.2.13. This makes it possible for authenticated attackers, with contributor access and above, to update the values of arbitrary site options to 'dismissed'.
Explanation of Vulnerability in Simple Terms
The Add to Cart Custom Redirect for WooCommerce plugin through version 1.2.13 lacks proper authorization checks on administrative functions. A logged-in user with low privileges can modify redirect settings and other plugin configuration without proper permission validation, potentially altering site behavior or redirecting customers to malicious URLs.
What an attacker can do
Modify plugin settings and redirect URLs without proper authorization.
Potential impact on your site
Customers could be redirected to phishing or malware sites; plugin configuration could be altered by unauthorized users.
Conditions required to exploit
Attacker must have a low-privilege user account (e.g., subscriber or customer) on the WooCommerce site.
Key dates
External resources
Related vulnerabilities
