CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
What the vulnerability does
Missing Authorization vulnerability in VillaTheme Thank You Page Customizer for WooCommerce woo-thank-you-page-customizer allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Thank You Page Customizer for WooCommerce: from n/a through <= 1.1.8.
Explanation of Vulnerability in Simple Terms
The Thank You Page Customizer for WooCommerce plugin for WordPress does not properly check user permissions before allowing access to certain administrative functions. A logged-in user with low privileges can view sensitive configuration data that should be restricted to site administrators. This affects all versions up to 1.1.8.
What an attacker can do
Read sensitive plugin configuration and settings data restricted to administrators.
Potential impact on your site
Unauthorized users can access private plugin settings and potentially sensitive WooCommerce configuration details.
Conditions required to exploit
Attacker must have a low-privilege WordPress user account (e.g., subscriber or contributor).
Key dates
External resources
Related vulnerabilities
