CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
What the vulnerability does
Missing Authorization vulnerability in WPClever WPC Smart Linked Products - Upsells & Cross-sells for WooCommerce wpc-smart-linked-products allows Privilege Escalation.This issue affects WPC Smart Linked Products - Upsells & Cross-sells for WooCommerce: from n/a through <= 1.3.5.
Explanation of Vulnerability in Simple Terms
WPC Smart Linked Products for WooCommerce versions up to 1.3.5 lack proper authorization checks, allowing authenticated users with low privileges to read, modify, or delete sensitive data. An attacker with a basic user account can access functionality intended only for administrators or shop managers, potentially compromising product configurations, pricing, and cross-sell settings.
What an attacker can do
Read, modify, or delete product data and linked product configurations without proper authorization.
Potential impact on your site
Unauthorized users can alter product relationships, pricing, and upsell/cross-sell logic, disrupting store operations and customer experience.
Conditions required to exploit
Attacker must have a low-privilege authenticated account (e.g., subscriber or customer role) on the WordPress site.
Key dates
External resources
