PT-2024-31719 · Unknown+1 · Woocommerce+1

Ali Maher

+1

·

Published

2024-05-21

·

Updated

2025-11-25

·

CVE-2024-4566

CVSS v3.1

7.1

High

VectorAV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H
Name of the Vulnerable Software and Affected Versions: ShopLentor plugin for WordPress versions up to, and including, 2.8.8
Description: The issue is related to a missing capability check on the ajax dismiss function, which allows authenticated attackers with contributor-level access and above to modify data by setting arbitrary WordPress options to "true". This can be exploited by attackers with subscriber- or customer-level access and above under certain conditions, such as when the WooCommerce plugin is deactivated or access to the default WordPress admin dashboard is explicitly enabled for authenticated users.
Recommendations: For versions up to, and including, 2.8.8, update to a version that includes a fix for this issue. As a temporary workaround, consider disabling the ajax dismiss function until a patch is available. Restrict access to the WordPress admin dashboard and ensure that the WooCommerce plugin is activated to minimize the risk of exploitation.

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2024-4566

Affected Products

Shoplentor
Woocommerce