CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
What the vulnerability does
Missing Authorization vulnerability in WPClever WPC Smart Upsell Funnel for WooCommerce wpc-smart-upsell-funnel allows Privilege Escalation.This issue affects WPC Smart Upsell Funnel for WooCommerce: from n/a through <= 3.0.4.
Explanation of Vulnerability in Simple Terms
WPC Smart Upsell Funnel for WooCommerce versions 3.0.4 and earlier lack proper authorization checks, allowing authenticated users with low privileges to read, modify, or delete sensitive data and functionality. An attacker with a basic user account can perform actions restricted to administrators or shop managers. Update to a version newer than 3.0.4 immediately.
What an attacker can do
Read, modify, or delete shop data and settings with only a low-privilege user account.
Potential impact on your site
Any registered user can access and alter critical WooCommerce upsell funnel settings and customer data.
Conditions required to exploit
Attacker must have a valid user account on the WordPress site (low privilege level).
Key dates
External resources
Related vulnerabilities
