CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L
What the vulnerability does
Missing Authorization vulnerability in WP Swings Points and Rewards for WooCommerce points-and-rewards-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Points and Rewards for WooCommerce: from n/a through <= 2.9.5.
Explanation of Vulnerability in Simple Terms
Points and Rewards for WooCommerce versions up to 2.9.5 lack proper authorization checks, allowing authenticated users to modify site data without appropriate permissions. An attacker with a low-privilege account can alter integrity of the rewards system or disable functionality. Update to a version newer than 2.9.5 to resolve this issue.
What an attacker can do
Modify or disable the Points and Rewards system without proper authorization.
Potential impact on your site
Unauthorized users can tamper with reward points, customer accounts, or plugin functionality.
Conditions required to exploit
Attacker must have a low-privilege user account on the WooCommerce site.
Key dates
External resources
Related vulnerabilities
