CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
What the vulnerability does
The Premmerce Brands for WooCommerce plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the saveBrandsSettings function in all versions up to, and including, 1.2.13. This makes it possible for authenticated attackers, with Subscriber-level access and above, to modify brand permalink settings.
Explanation of Vulnerability in Simple Terms
The Premmerce Brands for WooCommerce plugin through version 1.2.13 lacks proper authorization checks on certain administrative functions. A logged-in user with low privileges can modify brand data without proper permission validation. The vulnerability requires an active user account but does not require administrator access.
What an attacker can do
Modify brand data in the WooCommerce store without proper authorization.
Potential impact on your site
Unauthorized users can alter brand information, potentially damaging product listings and store credibility.
Conditions required to exploit
Attacker must have a low-privilege user account on the site (e.g., subscriber or customer role).
Key dates
External resources
