CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
What the vulnerability does
Missing Authorization vulnerability in javmah Woocommerce Customers Order History allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Woocommerce Customers Order History: from n/a through 5.2.2.
Explanation of Vulnerability in Simple Terms
The Woocommerce Customers Order History plugin through version 5.2.2 lacks proper authorization checks on certain functions. A logged-in user with low privileges can modify order data they should not have access to. The vulnerability requires an active user account but no special permissions. Update to a version newer than 5.2.2 to resolve this issue.
What an attacker can do
Modify order data belonging to other customers or the store.
Potential impact on your site
Customer order records can be altered by unauthorized users, risking data integrity and customer trust.
Conditions required to exploit
Attacker must have a valid user account with low-level access to the site.
Key dates
External resources
Related vulnerabilities
