CVE-2024-9189

Published: Sep 28, 2024Modified: Oct 3, 2024

5.3

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Exploitability: 3.9 / Impact: 1.4

Source: security@wordfence.com (Secondary)

Description

The EU/UK VAT Manager for WooCommerce plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the alg_wc_eu_vat_exempt_vat_from_admin() function in all versions up to, and including, 2.12.12. This makes it possible for unauthenticated attackers to update the VAT status for any order.

Affected (1)

Products: Wpfactory: Eu/uk Vat Manager For Woocommerce

1 product

Eu/uk Vat Manager For Woocommerce

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Wpfactory Eu/uk Vat Manager For Woocommerce	Before 2.12.14

Related CWEs

Missing Authorization

The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

References (3)

https://plugins.trac.wordpress.org/browser/eu-vat-for-woocommerce/tags/2.12.12/includes/class-alg-wc-eu-vat-ajax.php#L285

Source: security@wordfence.com

Product

https://plugins.trac.wordpress.org/changeset/3158296/

Source: security@wordfence.com

Patch

https://www.wordfence.com/threat-intel/vulnerabilities/id/c6db680e-1fd4-420c-98f4-2b6dc5cf6781?source=cve

Source: security@wordfence.com

Third Party Advisory

Timeline

No history available yet.