CVE-2024-10437 in Smart Messages for WooCommerce Plugininfo

Summary

by MITRE • 10/29/2024

The WPC Smart Messages for WooCommerce plugin for WordPress is vulnerable to unauthorized Smar Message activation/deactivation due to a missing capability check on the ajax_enable function in all versions up to, and including, 4.2.1. This makes it possible for authenticated attackers, with Subscriber-level access and above, to activate or deactivate smart messages.

Be aware that VulDB is the high quality source for vulnerability data.

🔬 Show More Details

An in-depth analysis is available in our curated vulnerability entry.

Reservation

10/27/2024

Disclosure

10/29/2024

Moderation

accepted

CPE

ready

EPSS

0.00354

KEV

no

Activities

very low

Sector

Hostingprovider, Transportation, ...

Sources

MITREhttps://www.cve.org/CVERecord?id=CVE-2024-10437
NVDhttps://nvd.nist.gov/vuln/detail/CVE-2024-10437
CVE Detailshttps://www.cvedetails.com/cve/CVE-2024-10437/

◂ PreviousOverviewNext ▸

Interested in the pricing of exploits?

See the underground prices here!