CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
What the vulnerability does
Missing Authorization vulnerability in ThemeSupport Hide Category by User Role for WooCommerce hide-category-by-user-role-for-woocommerce.This issue affects Hide Category by User Role for WooCommerce: from n/a through <= 2.1.1.
Explanation of Vulnerability in Simple Terms
The Hide Category by User Role for WooCommerce plugin through version 2.1.1 does not properly check user permissions before allowing modifications to category visibility settings. A logged-in user with low privileges can change which product categories are hidden or shown to other user roles, potentially exposing or restricting access to products unintentionally.
What an attacker can do
Modify product category visibility settings for other user roles without proper authorization.
Potential impact on your site
Product categories may be exposed or hidden incorrectly, disrupting intended access controls and potentially affecting sales or user experience.
Conditions required to exploit
Attacker must be logged in with a low-privilege account (e.g., subscriber or customer).
Key dates
External resources
Related vulnerabilities
