Incognito
+1
·
Published
2025-01-25
·
Updated
2025-01-25
·
CVE-2024-12826
4.3
Medium
| Base vector | Vector | AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N |
Name of the Vulnerable Software and Affected Versions:
GoHero Store Customizer for WooCommerce plugin for WordPress versions up to, and including, 3.5
Description:
The issue allows unauthorized modification of data due to a missing capability check on the `wooh action settings save frontend()` function. This makes it possible for unauthenticated attackers to update limited plugin settings.
Recommendations:
For versions up to, and including, 3.5, update to a version that includes a fix for the missing capability check in the `wooh action settings save frontend()` function.
As a temporary workaround, consider restricting access to the `wooh action settings save frontend()` function until a patch is available.
Fix
Missing Authorization