WordPress Plugin Vulnerabilities

Build Private Store For Woocommerce < 1.1 - Missing Authorization

Description

The Build Private Store For Woocommerce plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in all versions up to, and including, 1.0. This makes it possible for unauthenticated attackers to perform an unauthorized action.

Affects Plugins

Plugin icon
build-private-store-for-woocommerce
Fixed in 1.1

References

CVE
CVE-2025-24633
URL
https://www.wordfence.com/threat-intel/vulnerabilities/id/7a25d691-ba1e-41e6-9923-9c8d16b993a2

Classification

Type
NO AUTHORISATION
OWASP top 10
A5: Broken Access Control
CWE
CWE-862
CVSS
5.3 (medium)

Miscellaneous

Original Researcher
Kévin Mosbahi (Mika)
Verified
No
WPVDB ID
482fffd3-253d-4cce-bba9-50b8284f8663

Timeline

Publicly Published
2025-01-24 (about 1 year ago)
Added
2025-01-28 (about 1 year ago)
Last Updated
2025-01-28 (about 1 year ago)

Other

Published
Title
Published
2025-10-02
Title
Jock On Air Now (JOAN) < 6.0.5 - Missing Authorization
Published
2024-06-06
Title
Clever Fox – One Click Website Importer by Nayra Themes < 25.2.1 - Missing Authorization to arbitrary theme activation via clever-fox-activate-theme
Published
2024-10-24
Title
SEOPress < 8.2 - Missing Authorization
Published
2024-04-12
Title
Aspose.Words Exporter <= 6.3.1 - Missing Authorization
Published
2024-04-23
Title
Send PDF for Contact Form 7 < 1.0.2.4 - Missing Authorization