CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
What the vulnerability does
Missing Authorization vulnerability in tychesoftwares Product Delivery Date for WooCommerce – Lite product-delivery-date-for-woocommerce-lite allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Product Delivery Date for WooCommerce – Lite: from n/a through <= 3.2.0.
Explanation of Vulnerability in Simple Terms
Product Delivery Date for WooCommerce – Lite versions 3.2.0 and earlier lack proper authorization checks. An unauthenticated attacker can modify data through the plugin without permission. The vulnerability affects the plugin's core functionality and requires no user interaction to exploit.
What an attacker can do
Modify plugin data without authentication or authorization.
Potential impact on your site
Attackers can alter delivery date settings and related data, potentially disrupting order fulfillment workflows.
Conditions required to exploit
Network access to the WooCommerce site; no authentication required.
Key dates
External resources
Related vulnerabilities
