CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
What the vulnerability does
Missing Authorization vulnerability in WebToffee Product Feed for WooCommerce webtoffee-product-feed allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Product Feed for WooCommerce: from n/a through <= 2.2.8.
Explanation of Vulnerability in Simple Terms
Product Feed for WooCommerce versions up to 2.2.8 lack proper authorization checks, allowing authenticated users with low privileges to modify feed data they should not have access to. An attacker with a basic user account can alter product feed settings or content without proper permission validation. The vulnerability affects the plugin's core feed management functionality and could lead to data integrity issues.
What an attacker can do
Modify product feed data or settings without proper authorization.
Potential impact on your site
Unauthorized users can alter product feeds, potentially corrupting data sent to marketplaces or breaking feed functionality.
Conditions required to exploit
Attacker must have a low-privilege authenticated account on the WooCommerce site.
Key dates
External resources
