CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
What the vulnerability does
Improper Control of Generation of Code ('Code Injection') vulnerability in AlgolPlus Advanced Order Export For WooCommerce allows Code Injection.This issue affects Advanced Order Export For WooCommerce: from n/a through 3.4.4.
Explanation of Vulnerability in Simple Terms
Advanced Order Export For WooCommerce versions up to 3.4.4 contain a code injection vulnerability that allows high-privilege users to execute arbitrary PHP code on the site. An attacker with admin or equivalent access can inject malicious code through the plugin's export functionality, compromising the entire WordPress installation. The vulnerability affects the plugin's core export mechanism and requires administrative credentials to exploit.
What an attacker can do
Run arbitrary PHP code on the site with full server privileges.
Potential impact on your site
A compromised admin account can lead to complete site takeover, data theft, and malware installation.
Conditions required to exploit
Attacker must have admin-level access to the WordPress site.
Key dates
External resources
Related vulnerabilities
