CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N
What the vulnerability does
The ShopEngine Elementor WooCommerce Builder Addon – All in One WooCommerce Solution plugin for WordPress is vulnerable to unauthorized modification of data due to an insufficient capability check on the post_deactive() function and post_activate() function in all versions up to, and including, 4.8.4. This makes it possible for authenticated attackers, with Editor-level access and above, to activate and deactivate licenses.
Explanation of Vulnerability in Simple Terms
ShopEngine Elementor WooCommerce Builder Addon versions up to 4.8.4 contain an authorization flaw that allows high-privilege users to make unintended modifications. The vulnerability requires administrator-level access and does not expose sensitive data or disrupt site availability. Site owners should update to a version newer than 4.8.4 when available.
What an attacker can do
A high-privilege user can make unauthorized modifications to site data.
Potential impact on your site
Admins with compromised credentials could alter site content or settings beyond their intended scope.
Conditions required to exploit
Attacker must have administrator-level access to the WordPress site.
Key dates
External resources
Related vulnerabilities
