CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
What the vulnerability does
Missing Authorization vulnerability in Patterns in the cloud Autoship Cloud for WooCommerce Subscription Products allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Autoship Cloud for WooCommerce Subscription Products: from n/a through 2.14.0.
Explanation of Vulnerability in Simple Terms
Autoship Cloud for WooCommerce Subscription Products versions up to 2.14.0 lack proper authorization checks on certain operations. A logged-in user with low privileges can modify data they should not have access to, such as subscription settings or order details. The vulnerability requires an active user account but no special interaction from victims.
What an attacker can do
Modify subscription or order data belonging to other users or the site.
Potential impact on your site
Customers' subscription settings or orders could be altered by other logged-in users, risking data integrity and customer trust.
Conditions required to exploit
Attacker must have a low-privilege user account (e.g., customer login) on the WooCommerce site.
Key dates
External resources
Related vulnerabilities
