Improper access control in WooCommerce Smart Coupons - #VU25778
Published: March 5, 2020
Vulnerability identifier: #VU25778
CSH Severity: Medium
CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]
CVE-ID: N/A
CWE-ID: CWE-284
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to gain unauthorized access to otherwise restricted functionality.
The vulnerability exists due to improper access restrictions in the functionality which allows creation gift certificates which can be emailed to customers. A remote attacker can send themselves gift certificates of any value, which could be redeemed for products sold on the victim’s storefront.
Affected software
WooCommerce Smart Coupons
Remediation
Install updates from vendor's website.
WooCommerce Smart Coupons - update to 4.6.5