CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
What the vulnerability does
The WowRevenue plugin for WordPress is vulnerable to unauthorized plugin installation due to a missing capability check in the 'Notice::install_activate_plugin' function in all versions up to, and including, 2.1.3. This makes it possible for authenticated attackers, with subscriber-level access and above, to install arbitrary plugins on the affected site's server which may make remote code execution possible.
Explanation of Vulnerability in Simple Terms
WowRevenue versions up to 2.1.3 lack proper authorization checks, allowing authenticated users to read, modify, or delete sensitive data and functionality. An attacker with a low-privilege account can escalate their access to perform actions they should not be permitted to do. This affects confidentiality, integrity, and availability of the site.
What an attacker can do
Read, modify, or delete data and functionality they should not have access to.
Potential impact on your site
Authenticated users can bypass role restrictions and access or alter protected product bundle and discount settings.
Conditions required to exploit
Attacker must have a low-privilege user account on the site.
Key dates
External resources
Related vulnerabilities
