Discount Rules for WooCommerce <= 2.2.0 - Missing Authorization
2020-09-17 00:00
RamStrategic Overview
StatusPatched in 2.2.1
Affected PluginDiscount Rules for WooCommerce
Affected Version
<= 2.2.0CVSS6.3Medium
CVE
N/AVulnerability Overview
The Discount Rules for WooCommerce plugin for WordPress is vulnerable to missing authorization via several AJAX actions in versions up to, and including, 2.2.0 due to missing capability checks on various functions. This makes it possible for subscriber-level attackers to execute various actions and perform a wide variety of actions such as modifying discount rules.
Technical Analysis
REMEDIATION: Update to version 2.2.1, or a newer patched version --- IDENTIFIER: CWE-862 (Missing Authorization) The product does not perform an authorization check when an actor attempts to access a resource or perform an action.
External References
Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C