BCS BatchLine Book Importer <= 1.5.7 - Arbitrary Product Import/Update
mediumThe BCS BatchLine Book Importer plugin for WordPress is vulnerable to Unauthenticated Product Import/Update in versions up to, and including, 1.5.7. This is due to improper permission checks via the wc/v3/bcsbertlinebookimport REST route. This makes it possible for unauthenticated attackers to update existing products...
- CVSS:
- 6.5
- Affected:
- up to 1.5.7
- Fixed in:
- 1.5.8
- Disclosed:
- Jun 11, 2021