CVE-2024-12266: ELEX WooCommerce Dynamic Pricing and Discounts <= 2.1.7 - Missing Authorization
The ELEX WooCommerce Dynamic Pricing and Discounts plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the elexdpexportrules() and elexdpimportrules() functions in all versions up to, and including, 2.1.7. This makes it possible for unauthenticated attackers to import and export product rules along with obtaining phpinfo() data
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-12266?
CVE-2024-12266 has a medium severity level due to the potential for unauthorized access of sensitive data.
How do I fix CVE-2024-12266?
To fix CVE-2024-12266, update the ELEX WooCommerce Dynamic Pricing and Discounts plugin to version 2.1.8 or later.
What versions are affected by CVE-2024-12266?
CVE-2024-12266 affects all versions of the ELEX WooCommerce Dynamic Pricing and Discounts plugin up to and including version 2.1.7.
What functions are vulnerable in CVE-2024-12266?
The elex_dp_export_rules() and elex_dp_import_rules() functions are vulnerable in CVE-2024-12266 due to a lack of capability checks.
Can CVE-2024-12266 lead to data leaks?
Yes, CVE-2024-12266 can potentially lead to data leaks by allowing unauthorized access to export and import functions.