CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
What the vulnerability does
The Vchasno Kasa plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the mrkv_vchasno_kasa_wc_do_metabox_action() function in all versions up to, and including, 1.0.3. This makes it possible for unauthenticated attackers to generate invoices for arbitrary orders.
Explanation of Vulnerability in Simple Terms
The MORKVA Vchasno Kasa Integration plugin through version 1.0.3 lacks proper authorization checks on sensitive operations. An unauthenticated attacker can read limited data without valid credentials. The vulnerability requires only network access and no user interaction. Update to a version newer than 1.0.3 to remediate.
What an attacker can do
Read sensitive data from the integration without authentication.
Potential impact on your site
Unauthorized users can access sensitive information exposed by the integration.
Conditions required to exploit
Network access only; no authentication or user interaction required.
Key dates
External resources
Related vulnerabilities
