Custom Order Statuses For Woocommerce Vulnerabilities

The Custom Order Statuses for WooCommerce plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in all versions up to, and including, 1.5.2. This makes it possible for authenticated attackers, with subscriber-level access and above, to perform an unauthorized action.

CVSS:

4.3

Affected:

up to 1.5.2

Fix:

No patched version reported

Disclosed:

Apr 15, 2024

CVE-2024-32524 on NVD →

The Custom Order Statuses for WooCommerce plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.5.2. This is due to missing or incorrect nonce validation on multiple functions. This makes it possible for unauthenticated attackers to modify order statuses via a forged reque...

CVSS:

5.4

Affected:

up to 1.5.2

Fix:

No patched version reported

Disclosed:

Feb 20, 2024

CVE-2024-25930 on NVD →