CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
What the vulnerability does
Missing Authorization vulnerability in Anzar Ahmed Display product variations dropdown on shop page display-product-variations-dropdown-on-shop-page allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Display product variations dropdown on shop page: from n/a through <= 1.1.3.
Explanation of Vulnerability in Simple Terms
Display product variations dropdown on shop page versions 1.1.3 and earlier lack proper authorization checks. A logged-in user with low privileges can modify product variation data they should not have access to. The vulnerability does not expose sensitive information or disrupt site availability, but allows unauthorized changes to product listings.
What an attacker can do
Modify product variation data without proper authorization.
Potential impact on your site
Unauthorized users can alter product variations on your shop, potentially corrupting product data or pricing.
Conditions required to exploit
Attacker must be logged in with a low-privilege account (e.g., customer or subscriber).
Key dates
External resources
Related vulnerabilities
