BulkGate SMS Plugin for WooCommerce < 3.0.3 - Missing Authorization via Multiple AJAX Actions

2024-01-0400:00:00

wpscan.com

bulkgate

sms

woocommerce

wordpress

vulnerability

unauthorized access

capability check

ajax

security

subscriber-level access

6.7 Medium

AI Score

Confidence

Low

0.0004 Low

EPSS

Percentile

9.1%

JSON

Description The BulkGate SMS Plugin for WooCommerce plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on several functions hooked via AJAX in versions up to, and including, 3.0.2. This makes it possible for authenticated attackers, with subscriber-level access and above, to save module settings among other actions.