CVE-2023-4924CWE-352
BEAR <= 1.1.3.3 - Missing Authorization to Product Deletion
Medium · published October 20, 2023
What it is
The BEAR for WordPress is vulnerable to Missing Authorization in versions up to, and including, 1.1.3.3. This is due to missing capability checks on the woobe_bulkoperations_delete function. This makes it possible for authenticated attackers, with subscriber access or higher, to delete products.
The record
Technical detail
- CVSS v3.1
- 5.4 · MEDIUM
- Vector
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L
- CVSS v4.0
- Not supplied
- EPSS
- 0.00321 · 23.9th percentile
- Weakness
- CWE-352 · Cross-Site Request Forgery (CSRF)
- Published
- 2023-10-20T07:29Z
EPSS history
Timeline