CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L
What the vulnerability does
Missing Authorization vulnerability in Saad Iqbal License Manager for WooCommerce license-manager-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects License Manager for WooCommerce: from n/a through <= 3.0.17.
Explanation of Vulnerability in Simple Terms
License Manager for WooCommerce versions 3.0.17 and earlier lack proper authorization checks, allowing authenticated users to modify or disable license data without proper permission. An attacker with a low-privilege account can alter integrity of license records or cause service disruption. Update to a version newer than 3.0.17.
What an attacker can do
Modify or disable license records and disrupt license validation for other users.
Potential impact on your site
License enforcement may be bypassed; customers could use expired or invalid licenses; revenue and compliance at risk.
Conditions required to exploit
Attacker must have a low-privilege WooCommerce user account (e.g., customer or subscriber).
Key dates
External resources
Related vulnerabilities
