WooCommerce <= 8.5.2 - Missing Authorization to Private/Draft Product Disclosure
mediumThe WooCommerce plugin for WordPress is vulnerable to unauthorized access of data due to insufficient restrictions in the product shortcode in all versions up to, and including, 8.5.2. This makes it possible for authenticated attackers, with contributor-level access and above, to view private and draft products.
- CVSS:
- 4.3
- Affected:
- up to 8.6
- Fixed in:
- 8.6
- Disclosed:
- Mar 25, 2024