CVE-2024-13358

Name of the Vulnerable Software and Affected Versions The BuddyPress WooCommerce My Account Integration plugin versions up to, and including, 3.4.24

Description The issue is related to a missing capability check on the wc4bp delete page() function, allowing authenticated attackers with Subscriber-level access and above to update the plugin's page setting.

Recommendations For versions up to, and including, 3.4.24, update to a version that includes a fix for the missing capability check in the wc4bp delete page() function. As a temporary workaround, consider restricting access to the wc4bp delete page() function to prevent unauthorized updates to the plugin's page setting.