CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L
What the vulnerability does
Missing Authorization vulnerability in Appsbd Elite Notification – Sales Popup, Social Proof, FOMO & WooCommerce Notification allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Elite Notification – Sales Popup, Social Proof, FOMO & WooCommerce Notification: from 1.5 through n/a.
Explanation of Vulnerability in Simple Terms
The Elite Notification plugin for WooCommerce contains an authorization flaw that allows authenticated users to perform actions they should not have access to. An attacker with low-level account privileges can trigger unintended functionality by tricking a user into visiting a malicious link. The vulnerability affects data confidentiality, integrity, and availability across the site.
What an attacker can do
Perform unauthorized actions on the site by tricking a logged-in user into clicking a malicious link.
Potential impact on your site
A low-privilege user or attacker can read, modify, or disrupt site data and functionality beyond their intended permissions.
Conditions required to exploit
Attacker needs a low-privilege account on the site; victim must click a link or visit a page controlled by the attacker.
Key dates
External resources
Related vulnerabilities
