CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
What the vulnerability does
The Product Filter by WBW plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'approveNotice' action in all versions up to, and including, 3.0.0. This makes it possible for unauthenticated attackers to update the plugin's settings.
Explanation of Vulnerability in Simple Terms
Product Filter for WooCommerce by WBW versions 3.0.0 and earlier lack proper authorization checks. An attacker can modify product filter settings without authentication, potentially altering how products are displayed or filtered on the site. The vulnerability requires no user interaction and can be exploited remotely.
What an attacker can do
Modify product filter settings without logging in.
Potential impact on your site
Attackers can alter product filtering behavior, potentially disrupting customer experience or hiding/showing unintended products.
Conditions required to exploit
Network access to the WooCommerce site; no authentication required.
Key dates
External resources
Related vulnerabilities
