CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
What the vulnerability does
The WPC Smart Wishlist for WooCommerce plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'wishlist_quickview' AJAX action in all versions up to, and including, 5.0.4. This makes it possible for authenticated attackers, with Subscriber-level access and above, to view other user's wishlist data and information.
Explanation of Vulnerability in Simple Terms
WPC Smart Wishlist for WooCommerce versions up to 5.0.4 lack proper authorization checks, allowing authenticated users to access sensitive wishlist data they should not be able to view. An attacker with a low-privilege account can read other users' wishlist information without additional interaction. This affects the confidentiality of customer data stored in the plugin.
What an attacker can do
Read other users' wishlist data and associated information.
Potential impact on your site
Customer wishlist data may be exposed to other authenticated users, compromising privacy.
Conditions required to exploit
Attacker must have a valid WordPress user account with at least low-level privileges.
Key dates
External resources
