CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L
What the vulnerability does
Missing Authorization vulnerability in webchunky Order Delivery & Pickup Location Date Time order-delivery-pickup-location-date-time-free-version allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Order Delivery & Pickup Location Date Time: from n/a through <= 1.1.0.
Explanation of Vulnerability in Simple Terms
The Order Delivery & Pickup Location Date Time plugin for WordPress does not properly check user permissions before allowing modifications to delivery and pickup settings. An unauthenticated attacker can modify these settings over the network without needing to log in or interact with a site administrator. This affects versions 1.1.0 and earlier.
What an attacker can do
Modify delivery and pickup location settings without authentication.
Potential impact on your site
Attackers can alter your store's delivery and pickup options, disrupting customer orders and operations.
Conditions required to exploit
Network access to the WordPress site; no authentication or user interaction required.
Key dates
External resources
Related vulnerabilities
