CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
What the vulnerability does
Missing Authorization vulnerability in FantasticPlugins SUMO Memberships for WooCommerce sumomemberships allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects SUMO Memberships for WooCommerce: from n/a through < 7.8.0.
Explanation of Vulnerability in Simple Terms
SUMO Memberships for WooCommerce versions 7.8.0 and earlier lack proper authorization checks, allowing authenticated users to modify membership data they should not have access to. An attacker with a low-privilege account can change membership settings, status, or other critical fields without proper permission validation. This affects the integrity of membership records and customer data.
What an attacker can do
Modify membership records and settings belonging to other users or the site.
Potential impact on your site
Membership data integrity is compromised; customers' membership status, billing, or access levels can be altered by unauthorized users.
Conditions required to exploit
Attacker must have a valid low-privilege account on the site (e.g., customer or subscriber role).
Key dates
External resources
