CVE-2024-12266mediumCWE-862

CVE-2024-12266: falha de média gravidade em elextensions ELEX WooCommerce Dynamic Pricing…

ELEX WooCommerce Dynamic Pricing and Discounts <= 2.1.7 - Missing Authorization

Publicada em · Atualizada em

13Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 6.5epss 0.4%
probabilidade de exploração
0.4%top 73% das CVEs
exploração observada
nãonenhuma fonte reporta
The ELEX WooCommerce Dynamic Pricing and Discounts plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the elex_dp_export_rules() and elex_dp_import_rules() functions in all versions up to, and including, 2.1.7. This makes it possible for unauthenticated attackers to import and export product rules along with obtaining phpinfo() data
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Produtos afetados
elextensions · ELEX WooCommerce Dynamic Pricing and Discounts
Referências
https://plugins.trac.wordpress.org/browser/elex-woocommerce-dynamic-pricing-and-discounts/tags/2.1.7/admin/elex-exporter.php#L9https://plugins.trac.wordpress.org/browser/elex-woocommerce-dynamic-pricing-and-discounts/tags/2.1.7/admin/elex-importer.php#L8https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3211131%40elex-woocommerce-dynamic-pricing-and-discounts&new=3211131%40elex-woocommerce-dynamic-pricing-and-discounts&sfp_email=&sfph_mail=#file7https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3211131%40elex-woocommerce-dynamic-pricing-and-discounts&new=3211131%40elex-woocommerce-dynamic-pricing-and-discounts&sfp_email=&sfph_mail=#file8https://www.wordfence.com/threat-intel/vulnerabilities/id/063d452b-2a35-40aa-a002-ea55da778222?source=cve