PT-2023-12462

CVE-2021-4353

Published

2023-10-19

Updated

2023-10-26

Description by

CVSS 3.1

5.3

Medium

MetricsAV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions WooCommerce Dynamic Pricing and Discounts plugin for WordPress versions up to, and including, 2.4.1

Description The issue arises from missing authorization on the export() function, allowing unauthenticated attackers to export the plugin's settings. This affects the WooCommerce Dynamic Pricing and Discounts plugin for WordPress.

Recommendations For versions up to, and including, 2.4.1, update to a version higher than 2.4.1 to resolve the issue. As a temporary workaround, consider disabling the export() function until a patch is available.

Exploitability

Exploit

Fix

Impacts

Researchers

Jerome Bruandet

Vendors

Affected products

Weakness enumeration

CWE-288: Authentication Bypass Using an Alternate Path or Channel

CWE-862: Missing Authorization

Related identifiers