Lucene search

WpvulndbWPVDB-ID:54F59895-BA72-4430-8A75-777D68E165E0

HistoryFeb 02, 2024 - 12:00 a.m.

WooCommerce Conversion Tracking < 2.0.12 - Subscriber+ Addon Installation

2024-02-0200:00:00

wpscan.com

vulnerability

woocommerce

conversion tracking

unauthorized modification

data

capability check

authenticated users

subscriber

installation

happy elementor addons

plugin

6.8 Medium

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

9.1%

JSON

Description The plugin is vulnerable to unauthorized modification of data due to a missing capability check on the ‘wcct_install_happy_addons’ function, allowing any authenticated users, such as subscriber to install the Happy Elementor Addons plugin.

CPENameOperatorVersion
eq2.0.12

CPE	Name	Operator	Version
		eq	2.0.12

References

patchstack.com/database/vulnerability/woocommerce-conversion-tracking/wordpress-woocommerce-conversion-tracking-plugin-2-0-11-broken-access-control-csrf-vulnerability