CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L
What the vulnerability does
Missing Authorization vulnerability in Anzar Ahmed Ni WooCommerce Cost Of Goods ni-woocommerce-cost-of-goods allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Ni WooCommerce Cost Of Goods: from n/a through <= 3.2.8.
Explanation of Vulnerability in Simple Terms
The Ni WooCommerce Cost Of Goods plugin for WordPress does not properly check user permissions before allowing certain actions. A logged-in user with low privileges can modify or delete cost data and other settings they should not have access to. This affects all versions up to 3.2.8.
What an attacker can do
A low-privilege user can modify or delete cost data and plugin settings without authorization.
Potential impact on your site
Unauthorized users can corrupt product cost records and disrupt WooCommerce accounting and reporting.
Conditions required to exploit
Attacker must have a low-privilege WordPress account (e.g., subscriber or contributor role).
Key dates
External resources
