CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
What the vulnerability does
Missing Authorization vulnerability in AgniHD Cartify - WooCommerce Gutenberg WordPress Theme cartify allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Cartify - WooCommerce Gutenberg WordPress Theme: from n/a through <= 1.3.
Explanation of Vulnerability in Simple Terms
The Cartify WooCommerce Gutenberg theme for WordPress versions 0 through 1.3 lacks proper authorization checks on certain administrative functions. A logged-in user with low privileges can modify site data or settings they should not have access to. Update to a version newer than 1.3 to resolve this issue.
What an attacker can do
A low-privilege logged-in user can modify site data or settings without proper authorization.
Potential impact on your site
Unauthorized users can alter site content, settings, or data depending on which functions lack authorization checks.
Conditions required to exploit
Attacker must have a valid WordPress user account with low-level privileges (e.g., subscriber or contributor role).
Key dates
External resources
Related vulnerabilities
