GSheet For Woo Importer <= 2.3.1 - Missing Authorization to Authenticated (Subscriber+) Plugin Settings Reset
mediumThe GSheet For Woo Importer plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the process_ajax_restore_action() function in all versions up to, and including, 2.3.1. This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete t...
- CVSS:
- 4.3
- Affected:
- up to 2.3.1
- Fixed in:
- 2.4.1
- Disclosed:
- May 21, 2026