CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
What the vulnerability does
Missing Authorization vulnerability in templateinvaders TI WooCommerce Wishlist ti-woocommerce-wishlist allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects TI WooCommerce Wishlist: from n/a through <= 2.10.0.
Explanation of Vulnerability in Simple Terms
The TI WooCommerce Wishlist plugin through version 2.10.0 fails to properly check user permissions before allowing access to certain functions. An unauthenticated attacker can read sensitive information from the wishlist feature without authorization. This affects all installations of the plugin up to and including version 2.10.0.
What an attacker can do
Read wishlist data and other sensitive information without logging in.
Potential impact on your site
Wishlist data may be exposed to unauthorized visitors, potentially revealing customer preferences and behavior.
Conditions required to exploit
None. The attacker needs only network access; no authentication or user interaction required.
Key dates
External resources
Related vulnerabilities
