CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
What the vulnerability does
Incorrect Privilege Assignment vulnerability in extendons WooCommerce Registration Fields Plugin - Custom Signup Fields extendons-registration-fields allows Privilege Escalation.This issue affects WooCommerce Registration Fields Plugin - Custom Signup Fields: from n/a through <= 3.2.3.
Explanation of Vulnerability in Simple Terms
The WooCommerce Registration Fields Plugin allows authenticated users with low privileges to read sensitive data, modify site content, and disrupt service. The vulnerability stems from insufficient permission checks in the plugin's core functionality. An attacker with a basic user account can exploit this without user interaction. Sites running version 3.2.3 or earlier are affected.
What an attacker can do
Read sensitive data, modify content, and disrupt the site's availability with a low-privilege user account.
Potential impact on your site
Any registered user can access restricted data, alter site content, or cause downtime without admin approval.
Conditions required to exploit
Attacker must have a valid low-privilege user account on the site; no user interaction required.
Key dates
External resources
Related vulnerabilities
