CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
What the vulnerability does
Authentication Bypass Using an Alternate Path or Channel vulnerability in mediaticus Subaccounts for WooCommerce subaccounts-for-woocommerce allows Authentication Abuse.This issue affects Subaccounts for WooCommerce: from n/a through <= 1.6.6.
Explanation of Vulnerability in Simple Terms
Subaccounts for WooCommerce versions 1.6.6 and earlier contain an authentication bypass vulnerability. An attacker with low-level account access can read, modify, or delete sensitive data and functionality across the plugin without proper authorization checks. The vulnerability affects all confidentiality, integrity, and availability of the affected system.
What an attacker can do
Read, modify, or delete data and functionality across the plugin without proper authorization.
Potential impact on your site
Any registered user can access and modify subaccount data, orders, and settings they shouldn't have permission to touch.
Conditions required to exploit
Attacker needs a low-privilege WooCommerce account; no user interaction required.
Key dates
External resources
Related vulnerabilities
