PT-2023-12490 · WordPress · Woocommerce Multi Currency

Jerome Bruandet · Published 2023-06-07 · Updated 2023-06-14 · CVE-2021-4379

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions WooCommerce Multi Currency plugin for WordPress versions up to, and including, 2.1.17

Description The issue is related to authorization bypass due to a missing capability check on the wmc bulk fixed price function. This allows authenticated attackers with subscriber-level permissions and above to make changes to product prices.

Recommendations For versions up to, and including, 2.1.17, update to a version higher than 2.1.17 to resolve the issue. As a temporary workaround, consider restricting access to the wmc bulk fixed price function to prevent unauthorized changes to product prices.

Exploit

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2021-4379

Affected Products

Woocommerce Multi Currency

References · 7

• 🔥 https://blog.nintechnet.com/vulnerability-fixed-in-wordpress-woocommerce-multi-currency-plugin · Exploit
• https://osv.dev/vulnerability/CVE-2021-4379 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-4379 · Security Note
• https://codecanyon.net/item/woocommerce-multi-currency/20948446 · Note
• https://t.me/cvenotify/51947 · Telegram Post
• https://wordfence.com/threat-intel/vulnerabilities/id/e2318ae9-4115-442e-9293-a9251787c5f3?source=cve · Note
• https://t.me/cvenotify/51944 · Telegram Post