CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
What the vulnerability does
Missing Authorization vulnerability in WC Lovers WCFM Marketplace wc-multivendor-marketplace allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WCFM Marketplace: from n/a through <= 3.7.1.
Explanation of Vulnerability in Simple Terms
WCFM Marketplace versions up to 3.7.1 lack proper authorization checks, allowing high-privilege users to cause service disruptions. An attacker with administrative or vendor-level access can trigger a denial-of-service condition affecting site availability. The vulnerability does not expose data or allow unauthorized modifications. Update to a version newer than 3.7.1.
What an attacker can do
Cause the site to become unavailable or unresponsive by exploiting missing access controls.
Potential impact on your site
Marketplace may experience downtime or performance degradation if a privileged user exploits this flaw.
Conditions required to exploit
Attacker must have high-level privileges (admin or vendor account) on the site.
Key dates
External resources
Related vulnerabilities
