Lucene search

WordfenceCVE-2024-1639

HistoryJun 21, 2024 - 2:15 a.m.

CVE-2024-1639

2024-06-2102:15:10

CWE-863

Wordfence

web.nvd.nist.gov

wordpress

woocommerce

vulnerability

unauthorized access

data

capability check

admin dashboard

CVSS3

6.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

AI Score

6.2

Confidence

High

EPSS

0.001

Percentile

18.2%

JSON

The License Manager for WooCommerce plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the showLicenseKey() and showAllLicenseKeys() functions in all versions up to, and including, 3.0.7. This makes it possible for authenticated attackers, with admin dashboard access (contributors by default due to WooCommerce) to view arbitrary decrypted license keys. The functions contain a referrer nonce check. However, these can be retrieved via the dashboard through the “license” JS variable.

Affected configurations

Nvd

Vulners

Node

wpexpertslicense_manager_for_woocommerceRange≤3.0.7wordpress

VendorProductVersionCPE
wpexpertslicense_manager_for_woocommerce*cpe:2.3:a:wpexperts:license_manager_for_woocommerce:*:*:*:*:*:wordpress:*:*

Vendor	Product	Version	CPE
wpexperts	license_manager_for_woocommerce	*	cpe:2.3:a:wpexperts:license_manager_for_woocommerce::::::wordpress::*

CNA Affected

[
  {
    "vendor": "wpexpertsio",
    "product": "License Manager for WooCommerce",
    "versions": [
      {
        "version": "*",
        "status": "affected",
        "lessThanOrEqual": "3.0.7",
        "versionType": "semver"
      }
    ],
    "defaultStatus": "unaffected"
  }
]

References

plugins.trac.wordpress.org/browser/license-manager-for-woocommerce/tags/3.0.5/includes/Controllers/License.php

www.wordfence.com/threat-intel/vulnerabilities/id/92e444db-72d5-444f-811e-ade0bc097769?source=cve

CVSS3

6.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

AI Score

6.2

Confidence

High

EPSS

0.001

Percentile

18.2%

JSON

Related for CVE-2024-1639