CVE-2024-10860

Name of the Vulnerable Software and Affected Versions NextMove Lite – Thank You Page for WooCommerce plugin for WordPress versions up to, and including, 2.19.0

Description The issue arises from a missing capability check on the submit uninstall reason action() function, allowing authenticated attackers with Subscriber-level access and above to submit a deactivation reason on behalf of a site. This enables unauthorized submission of data.

Recommendations For versions up to, and including, 2.19.0, update to a version that includes a fix for the missing capability check on the submit uninstall reason action() function. As a temporary workaround, consider restricting access to the submit uninstall reason action() function to prevent unauthorized data submission.