CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
What the vulnerability does
The WooCommerce Google Feed Manager plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the 'wppfm_removeFeedFile' function in all versions up to, and including, 2.8.0. This makes it possible for authenticated attackers, with Contributor-level access and above, to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php).
Explanation of Vulnerability in Simple Terms
The WPMR Google Feed Manager for WooCommerce plugin through version 2.8.0 fails to properly check user permissions before allowing access to sensitive functions. An authenticated user with low privileges can perform actions normally restricted to administrators, including reading, modifying, or deleting site data. This affects all installations running the vulnerable version.
What an attacker can do
Read, modify, or delete site data without proper authorization.
Potential impact on your site
Any low-privilege user can access and alter critical plugin settings and WooCommerce data.
Conditions required to exploit
Attacker must have a low-privilege user account (e.g., subscriber or contributor) on the WordPress site.
Key dates
External resources
Related vulnerabilities
