CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L
What the vulnerability does
Missing Authorization vulnerability in Open Tools WooCommerce Basic Ordernumbers woocommerce-basic-ordernumbers allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WooCommerce Basic Ordernumbers: from n/a through <= 1.4.4.
Explanation of Vulnerability in Simple Terms
WooCommerce Basic Ordernumbers through version 1.4.4 fails to properly check user permissions before allowing modifications to order numbers. A logged-in user with low privileges can alter order numbers and availability status without authorization. This affects the integrity of order records in WooCommerce stores.
What an attacker can do
Modify order numbers and order availability status without proper authorization.
Potential impact on your site
Order data integrity is compromised; attackers can alter order numbers affecting billing, fulfillment, and audit trails.
Conditions required to exploit
Attacker must be logged in with a low-privilege account (e.g., customer or subscriber role).
Key dates
External resources
Related vulnerabilities
