CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
What the vulnerability does
Authentication Bypass Using an Alternate Path or Channel vulnerability in VillaTheme Abandoned Cart Recovery for WooCommerce woo-abandoned-cart-recovery allows Authentication Abuse.This issue affects Abandoned Cart Recovery for WooCommerce: from n/a through <= 1.1.12.
Explanation of Vulnerability in Simple Terms
The Abandoned Cart Recovery for WooCommerce plugin through version 1.1.12 contains an authentication bypass vulnerability. An attacker can read and modify sensitive cart and customer data without logging in. The plugin fails to properly validate user permissions on critical API endpoints, allowing unauthorized access to abandoned cart information and customer details.
What an attacker can do
Read and modify abandoned cart data and customer information without authentication.
Potential impact on your site
Customer cart data and personal information exposed; attackers can modify or delete abandoned cart records.
Conditions required to exploit
Network access to the WordPress site; no authentication or user interaction required.
Key dates
External resources
Related vulnerabilities
