CVE-2020-36696CWE-285

Product Input Fields for WooCommerce <= 1.2.6 - Missing Authorization

High · published June 7, 2023

CVSS v3.1
7.5
EPSS
1%
Percentile
64.8
In the wild
Unconfirmed
What it is

The Product Input Fields for WooCommerce plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on the handle_downloads() function in versions up to, and including, 1.2.6. This makes it possible for unauthenticated attackers to download files from the vulnerable service.

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.01079 · 64.8th percentile
Weakness
CWE-285 · Improper Authorization
Published
2023-06-07T01:51Z
EPSS history
Timeline
  • 07 JUN 01:51Z
    Product Input Fields for WooCommerce <= 1.2.6 - Missing Authorization
    cvelistv5