CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:L
What the vulnerability does
Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') vulnerability in Automattic WooCommerce allows Content Spoofing.This issue affects WooCommerce: from n/a through 8.9.2.
Explanation of Vulnerability in Simple Terms
WooCommerce versions up to 8.9.2 contain an input validation flaw that allows high-privilege users to modify site data when they interact with a malicious link or page. The vulnerability requires administrator access and user interaction to exploit. It does not affect confidentiality but can result in unintended changes to site content or functionality.
What an attacker can do
Modify WooCommerce data or settings if a site admin clicks a malicious link.
Potential impact on your site
An admin account could be tricked into making unintended changes to store data or settings.
Conditions required to exploit
Attacker must have administrator-level access and trick a site admin into clicking a link.
Key dates
External resources
Related vulnerabilities
