WordPress Plugin Vulnerabilities

Active Products Tables for WooCommerce < 1.0.6.8 - Unauthenticated Arbitrary Filter Call

Description

The plugin is vulnerable to unauthorized filter calling due to insufficient restrictions on the get_smth() function. This makes it possible for unauthenticated attackers to call arbitrary WordPress filters with a single parameter.

Affects Plugins

Plugin icon
profit-products-tables-for-woocommerce
Fixed in 1.0.6.8

References

CVE
CVE-2025-1514
URL
https://www.wordfence.com/threat-intel/vulnerabilities/id/6edf91de-9553-4aa1-a29f-89771c8e852e

Classification

Type
NO AUTHORISATION
OWASP top 10
A5: Broken Access Control
CWE
CWE-862
CVSS
7.3 (high)

Miscellaneous

Original Researcher
Arkadiusz Hydzik
Verified
No
WPVDB ID
f5905ca5-6a1c-4464-8a69-1099e711bf69

Timeline

Publicly Published
2025-03-25 (about 1 year ago)
Added
2025-03-26 (about 1 year ago)
Last Updated
2025-03-26 (about 1 year ago)

Other

Published
Title
Published
2025-05-01
Title
OTP-less one tap Sign in 2.0.14 - 2.0.59 - Unauthenticated Arbitrary Email Update to Account Takeover/Privilege Escalation
Published
2025-04-04
Title
MultiVendorX – The Ultimate WooCommerce Multivendor Marketplace Solution < 4.2.20 - Missing Authorization to Unauthenticated Table Rates Deletion
Published
2024-12-11
Title
Custom Skins Contact Form 7 <= 1.0 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Update and Skin Creation
Published
2025-04-02
Title
Shopify to WooCommerce Migration <= 1.3.0 - Missing Authorization to Unauthenticated Settings Update
Published
2023-10-03
Title
WP Custom Widget area <= 1.2.5 - Missing Authorization