PT-2024-15830 · Woocommerce · Active Products Tables For Woocommerce

Francesco Carlucci · Published 2024-02-05 · Updated 2024-02-13 · CVE-2024-0797

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions The Active Products Tables for WooCommerce versions up to, and including, 1.0.6.1

Description The issue allows unauthorized access to functionality due to a missing capability check on several functions. This makes it possible for subscribers and higher to execute functions intended for admin use.

Recommendations For versions up to, and including, 1.0.6.1, consider disabling the vulnerable functions until a patch is available. Restrict access to admin-intended functions to minimize the risk of exploitation.

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2024-0797

Affected Products

Active Products Tables For Woocommerce

References · 5

• https://plugins.trac.wordpress.org/changeset/3029488/profit-products-tables-for-woocommerce/trunk?contextall=1&old=3005088&old_path=%2Fprofit-products-tables-for-woocommerce%2Ftrunk · Patch
• https://osv.dev/vulnerability/CVE-2024-0797 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-0797 · Security Note
• https://twitter.com/CVEnew/status/1754636285367775603 · Twitter Post
• https://wordfence.com/threat-intel/vulnerabilities/id/0a94841f-b1dd-44f4-b7a1-65a9fdf7b18d?source=cve · Note