CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
What the vulnerability does
Missing Authorization vulnerability in xootix Waitlist Woocommerce ( Back in stock notifier ) allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Waitlist Woocommerce ( Back in stock notifier ): from n/a through 2.6.
Explanation of Vulnerability in Simple Terms
The Waitlist WooCommerce plugin through version 2.6 does not properly check user permissions before allowing modifications to waitlist data. An authenticated user with low privileges can alter waitlist entries they should not have access to. The vulnerability requires a valid user account but no special interaction from victims.
What an attacker can do
Modify waitlist entries belonging to other users or the site.
Potential impact on your site
Waitlist data integrity is compromised; customers' back-in-stock notifications may be altered or deleted.
Conditions required to exploit
Attacker must have a low-privilege user account on the site.
Key dates
External resources
Related vulnerabilities
