WordPress Plugin Vulnerabilities

Ultimate Custom Add To Cart Button <= 1.222.17 - Missing Authorization

Description

The plugin is vulnerable to unauthorized access due to a missing capability check on a function. This makes it possible for authenticated attackers, with subscriber-level access and above, to perform an unauthorized action.

Affects Plugins

Plugin icon
custom-add-to-cart-button-for-woocommerce
No known fix

References

CVE
CVE-2024-37202
URL
https://patchstack.com/database/wordpress/plugin/custom-add-to-cart-button-for-woocommerce/vulnerability/wordpress-ultimate-custom-add-to-cart-button-ajax-for-woocommerce-by-binary-carpenter-plugin-1-222-16-broken-access-control-to-xss-vulnerability

Classification

Type
NO AUTHORISATION
OWASP top 10
A5: Broken Access Control
CWE
CWE-862
CVSS
4.3 (medium)

Miscellaneous

Original Researcher
Abdi Pranata
Verified
No
WPVDB ID
c7aae5fd-3583-4d68-8efb-5865da3a9181

Timeline

Publicly Published
2024-06-20 (about 2 years ago)
Added
2024-06-26 (about 2 years ago)
Last Updated
2025-01-10 (about 1 year ago)

Other

Published
Title
Published
2024-03-11
Title
LadiApp <= 4.4 - Missing Authorization via save_config()
Published
2026-01-19
Title
LearnPress – WordPress LMS Plugin < 4.3.2.5 - Missing Authorization to Unauthenticated Sensitive User Information Disclosure via REST API
Published
2025-09-15
Title
Blaze Demo Importer < 1.0.13 - Missing Authorization to Authenticated (Subscriber+) Limited Plugin Install
Published
2023-07-25
Title
Ninja Forms < 3.6.26 - Contributor+ Form Entries Export
Published
2024-12-03
Title
TI WooCommerce Wishlist < 2.9.2 - Unauthenticated Plugin Setup Wizard Access