CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
What the vulnerability does
The Customer Reviews for WooCommerce plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'woocommerce_json_search_coupons' function . This makes it possible for attackers with subscriber level access to view coupon codes.
Explanation of Vulnerability in Simple Terms
The Customer Reviews for WooCommerce plugin through version 5.46.0 fails to properly check user permissions before allowing access to sensitive review data. A logged-in user with low privileges can read reviews and associated information they should not have access to. The vulnerability requires an active user account but no special interaction from the victim.
What an attacker can do
Read reviews and review data that should be restricted to other users or administrators.
Potential impact on your site
Customer review data may be exposed to unauthorized users, compromising privacy and potentially revealing sensitive information.
Conditions required to exploit
Attacker must have a low-privilege user account on the WooCommerce site.
Key dates
External resources
Related vulnerabilities
