CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L
What the vulnerability does
Missing Authorization vulnerability in cscode WooCommerce Manager – Customize and Control Cart page, Add to Cart button, Checkout fields easily innovs-woo-manager allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WooCommerce Manager – Customize and Control Cart page, Add to Cart button, Checkout fields easily: from n/a through <= 1.2.4.5.
Explanation of Vulnerability in Simple Terms
The WooCommerce Manager plugin for WordPress contains an authorization flaw that allows authenticated users with low privileges to modify cart and checkout settings they should not have access to. An attacker with a basic user account can alter cart page customization, add-to-cart button behavior, and checkout field configuration. This affects all versions up to 1.2.4.5. Site owners should update to a version newer than 1.2.4.5 when available.
What an attacker can do
Modify cart page settings, add-to-cart buttons, and checkout fields without proper authorization.
Potential impact on your site
Unauthorized users can alter critical e-commerce functionality, potentially disrupting checkout flow or customer experience.
Conditions required to exploit
Attacker must have a low-privilege WordPress user account (e.g., subscriber or contributor role).
Key dates
External resources
Related vulnerabilities
