CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
What the vulnerability does
Missing Authorization vulnerability in Kaira StoreCustomizer woocustomizer allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects StoreCustomizer: from n/a through <= 2.6.3.
Explanation of Vulnerability in Simple Terms
StoreCustomizer versions 2.6.3 and earlier lack proper authorization checks, allowing authenticated users with low privileges to read sensitive data they should not access. An attacker with a basic user account can retrieve confidential information without additional interaction. This affects the confidentiality of stored data but does not allow modification or deletion.
What an attacker can do
Read sensitive data belonging to other users or the site by exploiting missing authorization checks.
Potential impact on your site
User data and confidential information may be exposed to any authenticated account holder, even those with minimal permissions.
Conditions required to exploit
Attacker must have a low-privilege user account on the site; no special interaction required.
Key dates
External resources
Related vulnerabilities
