PT-2023-12462

CVE-2021-4353

Publicado

2023-10-19

Atualizado

2023-10-26

Descrição por

CVSS 3.1

5.3

Média

MétricasAV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions WooCommerce Dynamic Pricing and Discounts plugin for WordPress versions up to, and including, 2.4.1

Description The issue arises from missing authorization on the export() function, allowing unauthenticated attackers to export the plugin's settings. This affects the WooCommerce Dynamic Pricing and Discounts plugin for WordPress.

Recommendations For versions up to, and including, 2.4.1, update to a version higher than 2.4.1 to resolve the issue. As a temporary workaround, consider disabling the export() function until a patch is available.

Explorabilidade

Exploit

Correção

Impactos

Pesquisadores

Jerome Bruandet

Fornecedores

Produtos afetados

Enumeração de fraquezas

CWE-288: Authentication Bypass Using an Alternate Path or Channel

CWE-862: Missing Authorization

Identificadores relacionados