CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
What the vulnerability does
Missing Authorization vulnerability in aleswebs AdMail – Multilingual Back in-Stock Notifier for WooCommerce admail allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects AdMail – Multilingual Back in-Stock Notifier for WooCommerce: from n/a through <= 1.7.0.
Explanation of Vulnerability in Simple Terms
The AdMail plugin for WooCommerce versions 1.7.0 and earlier lack proper authorization checks on certain functions. A logged-in user with low privileges can modify data they should not have access to, such as notification settings or subscriber information. The vulnerability requires an active user account but no special permissions.
What an attacker can do
A logged-in user can modify notification settings or subscriber data they should not have access to.
Potential impact on your site
Unauthorized users can alter back-in-stock notifications, subscriber lists, or plugin configuration, potentially disrupting customer communications.
Conditions required to exploit
Attacker must have a valid WooCommerce user account with low-level privileges (e.g., subscriber or customer role).
Key dates
External resources
