WordPress Plugin Vulnerabilities

Booster for WooCommerce < 7.1.0 - Shop Manager+ Missing Authorization to Arbitrary Options Update

Description

The plugin is vulnerable to unauthorized modification of data due to a missing capability check on the 'manage_options' function in versions up to, and including, 7.0.0. This makes it possible for authenticated attackers with Shop Manager privileges to update arbitrary site options.

Affects Plugins

Plugin icon
woocommerce-jetpack
Fixed in 7.1.0

Classification

Type
NO AUTHORISATION
OWASP top 10
A5: Broken Access Control
CWE
CWE-862
CVSS
4.7 (medium)

Miscellaneous

Verified
No
WPVDB ID
eff37fad-7c19-43a1-a88d-0c10c1f75e16

Timeline

Publicly Published
2023-08-01 (about 2 years ago)
Added
2023-09-14 (about 2 years ago)
Last Updated
2023-09-14 (about 2 years ago)

Other

Published
Title
Published
2025-01-14
Title
RomethemeKit For Elementor < 1.5.4 - Missing Authorization in save_options and reset_widgets
Published
2025-01-14
Title
Envo Multipurpose <= 1.1.6 - Missing Authorization
Published
2025-01-16
Title
radSLIDE <= 2.1 - Missing Authorization
Published
2024-06-24
Title
Zita Elementor Site Library < 1.6.3 - Missing Authorization to Page Creation and Options Modification
Published
2025-12-06
Title
Actionwear products sync <= 2.3.3 - Missing Authorization