CVE-2024-10437

Name of the Vulnerable Software and Affected Versions WPC Smart Messages for WooCommerce plugin for WordPress versions up to, and including, 4.2.1

Description The issue allows authenticated attackers with Subscriber-level access and above to activate or deactivate smart messages due to a missing capability check on the ajax enable function. This makes it possible for attackers to unauthorizedly modify smart message settings.

Recommendations For versions up to, and including, 4.2.1, update to a version that includes a fix for the missing capability check on the ajax enable function to prevent unauthorized smart message activation or deactivation. As a temporary workaround, consider restricting access to the ajax enable function to prevent exploitation until a patch is available.