CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
What the vulnerability does
Missing Authorization vulnerability in ELEXtensions ELEX WooCommerce Request a Quote elex-request-a-quote allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects ELEX WooCommerce Request a Quote: from n/a through <= 2.3.9.
Explanation of Vulnerability in Simple Terms
The ELEX WooCommerce Request a Quote plugin through version 2.3.9 lacks proper authorization checks on certain functions. A logged-in user with low privileges can modify quote data without proper permission validation. The vulnerability allows unauthorized changes to quote information but does not expose sensitive data or disrupt site availability.
What an attacker can do
Modify quote data without proper authorization as a low-privilege logged-in user.
Potential impact on your site
Customers or low-privilege users could alter quote records, potentially affecting order accuracy and business operations.
Conditions required to exploit
Attacker must have a low-privilege account on the site (e.g., customer or subscriber role).
Key dates
External resources
Related vulnerabilities
