CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L
What the vulnerability does
Missing Authorization vulnerability in BinaryCarpenter Ultimate Custom Add To Cart Button (Ajax) For WooCommerce by Binary Carpenter custom-add-to-cart-button-for-woocommerce.This issue affects Ultimate Custom Add To Cart Button (Ajax) For WooCommerce by Binary Carpenter: from n/a through <= 1.222.17.
Explanation of Vulnerability in Simple Terms
A missing authorization flaw in Ultimate Custom Add To Cart Button (Ajax) For WooCommerce allows authenticated users to perform actions they should not be able to. The vulnerability requires user interaction and affects versions up to 1.222.17. An attacker with low-level site access can read, modify, or delete limited data, and the impact may extend beyond the plugin itself.
What an attacker can do
Read, modify, or delete data that should be restricted to higher-privilege users.
Potential impact on your site
Unauthorized users can access or alter WooCommerce cart and product settings they should not control.
Conditions required to exploit
Attacker must have a low-privilege account on the site and trick a user into clicking a malicious link.
Key dates
External resources
Related vulnerabilities
