CVE-2023-4703

All in One B2B for WooCommerce <= 1.0.3 - Unauthenticated Privilege Escalation

High · published January 16, 2024

CVSS v3.1
7.5
EPSS
1%
Percentile
52.1
In the wild
Unconfirmed
What it is

The All in One B2B for WooCommerce WordPress plugin through 1.0.3 does not properly validate parameters when updating user details, allowing an unauthenticated attacker to update the details of any user. Updating the password of an Admin user leads to privilege escalation.

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
CVSS v4.0
Not supplied
EPSS
0.00687 · 52.1th percentile
Published
2024-01-16T15:56Z
EPSS history
Timeline
  • 16 JAN 15:56Z
    All in One B2B for WooCommerce <= 1.0.3 - Unauthenticated Privilege Escalation
    cvelistv5