CVE-2024-33956 MEDIUM

CVE-2024-33956: WordPress Custom WooCommerce Checkout Fields Editor plugin <= 1.3.0 - Broken Access Control vulnerability

Vendor Themelocation
Product Custom WooCommerce Checkout Fields Editor
Weakness CWE-862 · Missing authorization
Published May 2, 2024
Last update April 28, 2026
View on NVD All CVEs

CVSS base score

4.3/10
Attack vector Network
Attack complexity Low
Privileges required Low
User interaction None
Confidentiality None
Integrity Low

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

What the vulnerability does

01Description

Missing Authorization vulnerability in ThemeLocation Custom WooCommerce Checkout Fields Editor.This issue affects Custom WooCommerce Checkout Fields Editor: from n/a through 1.3.0.

Explanation of Vulnerability in Simple Terms

02Summary

The Custom WooCommerce Checkout Fields Editor plugin through version 1.3.0 does not properly check user permissions before allowing modifications to checkout fields. A logged-in user with low privileges can alter checkout field settings that should be restricted to administrators, potentially changing form behavior or data collection without authorization.

What an attacker can do

03Attacker Capabilities

Modify WooCommerce checkout field settings without proper authorization.

Potential impact on your site

04Site Impact

Unauthorized users can alter your checkout form fields, potentially disrupting transactions or collecting unintended customer data.

Conditions required to exploit

05Prerequisites

Attacker must have a low-privilege user account on the site (e.g., customer or subscriber role).

Key dates

06Disclosure timeline

May 2, 2024 CVE published
April 28, 2026 Record updated

Related vulnerabilities

08Related CVE

CVE-2026-57669 WordPress Advanced Contact form 7 DB plugin <= 2.0.9 - Broken Access Control vulnerability CVE-2026-11773 Masteriyo LMS <= 2.2.1 - Missing Authorization to Authenticated (Student+) Arbitrary Course Announcement Modification CVE-2026-57355 WordPress Classified Listing plugin <= 5.4.2 - Broken Access Control vulnerability CVE-2026-12133 JoomSport <= 5.7.8 - Authenticated (Subscriber+) Missing Authorization to Arbitrary Group Deletion via season_groupdel AJAX action CVE-2026-40722 WordPress Yoast SEO Premium plugin <= 26.6 - Broken Access Control vulnerability