CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
What the vulnerability does
Improper Control of Generation of Code ('Code Injection') vulnerability in acowebs Dynamic Pricing With Discount Rules for WooCommerce aco-woo-dynamic-pricing allows Code Injection.This issue affects Dynamic Pricing With Discount Rules for WooCommerce: from n/a through <= 4.5.9.
Explanation of Vulnerability in Simple Terms
A code injection vulnerability in Dynamic Pricing With Discount Rules for WooCommerce versions up to 4.5.9 allows high-privileged users to inject and execute arbitrary PHP code on the site. An attacker with admin or equivalent access can modify pricing rules or settings to execute malicious code, potentially compromising the entire WooCommerce installation and customer data.
What an attacker can do
Run arbitrary PHP code on the site with full site access.
Potential impact on your site
A compromised admin account can lead to data theft, malware installation, and complete site takeover.
Conditions required to exploit
Attacker must have high-level admin or equivalent privileges on the WordPress site.
Key dates
External resources
