CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
What the vulnerability does
The Product Filtering by Categories, Tags, Price Range for WooCommerce – Filter Plus plugin for WordPress is vulnerable to unauthorized modification of data in all versions up to, and including, 1.1.6 due to a missing capability check on the 'filter_save_settings' and 'add_filter_options' AJAX actions. This makes it possible for unauthenticated attackers to modify the plugin's settings and create arbitrary filter options.
Explanation of Vulnerability in Simple Terms
Filter Plus versions 1.1.6 and earlier lack proper authorization checks on certain administrative functions. An attacker without authentication can modify plugin settings or data, potentially altering how product filters display or function on the site. Update to a version newer than 1.1.6 to resolve this issue.
What an attacker can do
Modify plugin settings or filter data without logging in.
Potential impact on your site
Attackers can alter product filter behavior, potentially disrupting customer experience or injecting malicious filter configurations.
Conditions required to exploit
Network access to the WordPress site; no authentication required.
Key dates
External resources
