CVE-2024-11281

creationtimestamp| type| source ---|---|--- 2024-12-25 06:45:20+00:00| seen| https://infosec.exchange/users/cve/statuses/113712111287479752 2024-12-25 07:15:37+00:00| seen| https://bsky.app/profile/cve-notifications.bsky.social/post/3le4fzk4rsr2i 2024-12-25 08:47:49+00:00| seen|...

CVE-2024-11281

CVE-2024-11281 affects WooCommerce Point of Sale for WordPress. The vulnerability arises from insufficient validation of the logged_in_user_id value when option values are empty, enabling change of email on arbitrary user accounts (including administrators) and password resets. Affected versions ...

CVE-2024-11281 WooCommerce Point of Sale <= 6.1.0 - Insecure Direct Object Reference to Privilege Escalation via Arbitrary User Email Change

The WooCommerce Point of Sale plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 6.1.0. This is due to insufficient validation on the 'loggedinuserid' value when option values are empty and the ability for attackers to change the email of arbitrary us...