CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
What the vulnerability does
The Ni WooCommerce Customer Product Report plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the ni_woocpr_action() function in all versions up to, and including, 1.2.4. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update plugin settings.
Explanation of Vulnerability in Simple Terms
The Ni WooCommerce Customer Product Report plugin for WordPress does not properly check user permissions before allowing modifications to report data. A logged-in user with low privileges can alter reports they should not have access to. The vulnerability affects versions up to 1.2.4. Update to a version newer than 1.2.4 to resolve this issue.
What an attacker can do
Modify or tamper with customer product reports without proper authorization.
Potential impact on your site
Unauthorized users can alter report data, compromising the integrity of customer analytics and business intelligence.
Conditions required to exploit
Attacker must be logged in to the WordPress site with a low-privilege account (e.g., subscriber or contributor).
Key dates
External resources
