CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
What the vulnerability does
Missing Authorization vulnerability in WebToffee Product Feed for WooCommerce webtoffee-product-feed allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Product Feed for WooCommerce: from n/a through <= 2.3.1.
Explanation of Vulnerability in Simple Terms
Product Feed for WooCommerce versions up to 2.3.1 lack proper authorization checks, allowing authenticated users with low privileges to access sensitive product feed data they should not see. An attacker with a basic user account can read feed information without proper permission validation. This affects confidentiality but not data integrity or availability.
What an attacker can do
Read product feed data that should be restricted to higher-privilege users.
Potential impact on your site
Unauthorized users can view sensitive product feed configuration and data, potentially exposing business information.
Conditions required to exploit
Attacker must have a low-privilege authenticated account on the WooCommerce site.
Key dates
External resources
Related vulnerabilities
