CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
What the vulnerability does
Missing Authorization vulnerability in Tyche Softwares Payment Gateway Based Fees and Discounts for WooCommerce.This issue affects Payment Gateway Based Fees and Discounts for WooCommerce: from n/a through 2.12.1.
Explanation of Vulnerability in Simple Terms
The Payment Gateway Based Fees and Discounts for WooCommerce plugin through version 2.12.1 lacks proper authorization checks on certain administrative functions. A logged-in user with low privileges can modify fee and discount settings without proper permission validation. This allows unauthorized changes to pricing rules that affect all store customers.
What an attacker can do
Modify payment gateway fees and discount settings without authorization.
Potential impact on your site
Unauthorized users can alter your store's pricing rules, fees, and discounts, potentially causing revenue loss or customer confusion.
Conditions required to exploit
Attacker must have a low-privilege user account (e.g., customer or subscriber role) on the WooCommerce site.
Key dates
External resources
Related vulnerabilities
