CVE-2024-11725: SMS Alert Order Notifications – WooCommerce <= 3.7.6 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Options Update
The SMS Alert Order Notifications – WooCommerce plugin for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation due to a missing capability check on the updateWcWarrantySettings() function in all versions up to, and including, 3.7.6. This makes it possible for authenticated attackers, with subscriber-level access and above, to update arbitrary options on the WordPress site. This can be leveraged to update the default role for registration to administrator and enable user registration for attackers to gain administrative user access to a vulnerable site. Please note this requires the woocommerce-warranty plugin to be installed in order to be exploited.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2024-11725?
CVE-2024-11725 is classified as a medium severity vulnerability due to its potential for unauthorized data modification leading to privilege escalation.
How do I fix CVE-2024-11725?
To fix CVE-2024-11725, update the SMS Alert Order Notifications plugin for WooCommerce to version 3.7.7 or higher where the capability check has been implemented.
Which versions are affected by CVE-2024-11725?
CVE-2024-11725 affects all versions of the SMS Alert Order Notifications plugin for WooCommerce up to and including version 3.7.6.
What type of vulnerability is CVE-2024-11725?
CVE-2024-11725 is an authorization vulnerability that allows unauthorized modification of data in the WooCommerce plugin.
Is there a workaround for CVE-2024-11725 if I cannot update?
Currently, there is no known workaround for CVE-2024-11725, and the best course of action is to update the plugin to the latest version.