CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
What the vulnerability does
The Search, Filters & Merchandising for WooCommerce plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'wcis_save_email' endpoint in all versions up to, and including, 3.0.67. This makes it possible for authenticated attackers, with Subscriber-level access and above, to deactivate the plugin.
Explanation of Vulnerability in Simple Terms
The Search, Filters & Merchandising for WooCommerce plugin through version 3.0.67 lacks proper authorization checks on certain functions. A logged-in user with low privileges can modify data they should not have access to. The vulnerability has low integrity impact and does not affect confidentiality or availability.
What an attacker can do
A low-privilege logged-in user can modify data they should not have permission to change.
Potential impact on your site
Unauthorized users may alter plugin settings, product data, or search/filter configurations.
Conditions required to exploit
Attacker must have a low-privilege account on the site (e.g., subscriber or customer role).
Key dates
External resources
