WooCommerce Blocks <= 3.7.0 - Authorization Bypass
2020-11-05 00:00
AnonymousStrategic Overview
Vulnerability Overview
The WooCommerce Blocks plugins for WordPress is vulnerable to authorization bypass in versions up to, and including, 3.7.0. This is due to insufficient validation on the account creation processes during checkout. This makes it possible for an unauthenticated attacker to register an account on WooCommerce sites even when the setting to enable account creation was not active.
Technical Analysis
REMEDIATION: Update to version 3.7.1, or a newer patched version --- IDENTIFIER: CWE-285 (Improper Authorization) The product does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action.
External References
Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C