YITH WooCommerce Account Funds Premium Plugin up to 1.33.0 on WordPress authorization

Summaryinfo

A vulnerability classified as problematic has been found in YITH WooCommerce Account Funds Premium Plugin up to 1.33.0 on WordPress. This affects an unknown function. The manipulation leads to authorization. This vulnerability is traded as CVE-2024-30470. It is possible to initiate the attack remotely. There is no exploit available.

Detailsinfo

A vulnerability was found in YITH WooCommerce Account Funds Premium Plugin up to 1.33.0 on WordPress and classified as problematic. This issue affects some unknown processing. The manipulation with an unknown input leads to a authorization vulnerability. Using CWE to declare the problem leads to CWE-862. The product does not perform an authorization check when an actor attempts to access a resource or perform an action. Impacted is integrity. The summary by CVE is:

Missing Authorization vulnerability in YITH YITH WooCommerce Account Funds Premium.This issue affects YITH WooCommerce Account Funds Premium: from n/a through 1.33.0.

The weakness was shared by Dave Jong. It is possible to read the advisory at patchstack.com. The identification of this vulnerability is CVE-2024-30470 since 03/27/2024. The exploitation is known to be easy. The attack may be initiated remotely. The technical details are unknown and an exploit is not publicly available.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Productinfo

Type

• E-Commerce Management Software

Vendor

• YITH

Name

• WooCommerce Account Funds Premium Plugin

Version

• 1.0
• 1.1
• 1.2
• 1.3
• 1.4
• 1.5
• 1.6
• 1.7
• 1.8
• 1.9
• 1.10
• 1.11
• 1.12
• 1.13
• 1.14
• 1.15
• 1.16
• 1.17
• 1.18
• 1.19
• 1.20
• 1.21
• 1.22
• 1.23
• 1.24
• 1.25
• 1.26
• 1.27
• 1.28
• 1.29
• 1.30
• 1.31
• 1.32
• 1.33.0

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion