CVE-2024-12266CWE-862

ELEX WooCommerce Dynamic Pricing and Discounts <= 2.1.7 - Missing Authorization

Medium · published December 24, 2024

CVSS v3.1
6.5
EPSS
0%
Percentile
27.7
In the wild
Unconfirmed
What it is

The ELEX WooCommerce Dynamic Pricing and Discounts plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the elex_dp_export_rules() and elex_dp_import_rules() functions in all versions up to, and including, 2.1.7. This makes it possible for unauthenticated attackers to import and export product rules along with obtaining phpinfo() data

The record
Technical detail
CVSS v3.1
6.5 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00353 · 27.7th percentile
Weakness
CWE-862 · Missing Authorization
Published
2024-12-24T04:22Z
EPSS history
Timeline
  • 24 DEC 04:22Z
    ELEX WooCommerce Dynamic Pricing and Discounts <= 2.1.7 - Missing Authorization
    cvelistv5