CVE-2021-4353CWE-288

WooCommerce Dynamic Pricing and Discounts <= 2.4.1 - Unauthenticated Settings Import/Export

Medium · published October 20, 2023

CVSS v3.1
5.3
EPSS
1%
Percentile
52.8
In the wild
Unconfirmed
What it is

The WooCommerce Dynamic Pricing and Discounts plugin for WordPress is vulnerable to unauthenticated settings export in versions up to, and including, 2.4.1. This is due to missing authorization on the export() function which makes makes it possible for unauthenticated attackers to export the plugin's settings.

The record
Technical detail
CVSS v3.1
5.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00705 · 52.8th percentile
Weakness
CWE-288 · Authentication Bypass Using an Alternate Path or Channel
Published
2023-10-20T06:35Z
EPSS history
Timeline
  • 20 OCT 06:35Z
    WooCommerce Dynamic Pricing and Discounts <= 2.4.1 - Unauthenticated Settings Import/Export
    cvelistv5