CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
What the vulnerability does
Missing Authorization vulnerability in WPClever WPC Product Bundles for WooCommerce woo-product-bundle allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WPC Product Bundles for WooCommerce: from n/a through <= 8.4.5.
Explanation of Vulnerability in Simple Terms
WPC Product Bundles for WooCommerce versions up to 8.4.5 lack proper authorization checks, allowing authenticated users to access sensitive product bundle information they should not see. An attacker with a low-privilege account can read data about bundles without proper permission validation. This affects confidentiality but not data integrity or availability.
What an attacker can do
Read product bundle data and pricing information they should not have access to.
Potential impact on your site
Customer or vendor accounts can view confidential bundle pricing and product configurations.
Conditions required to exploit
Attacker must have a valid WooCommerce user account with at least low-level privileges.
Key dates
External resources
Related vulnerabilities
