CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
What the vulnerability does
Missing Authorization vulnerability in WebToffee Comments Import & Export comments-import-export-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Comments Import & Export: from n/a through <= 2.4.9.
Explanation of Vulnerability in Simple Terms
Comments Import & Export versions up to 2.4.9 lack proper authorization checks, allowing authenticated users with low privileges to read sensitive data from other users or site areas. The vulnerability affects the scope beyond the plugin itself. No user interaction is required from the victim. Update to a version newer than 2.4.9.
What an attacker can do
Read sensitive data from other users or restricted site areas without proper authorization.
Potential impact on your site
Low-privilege users can access confidential information they shouldn't see, including other users' data.
Conditions required to exploit
Attacker must have a low-privilege authenticated account on the site.
Key dates
External resources
Related vulnerabilities
