CVE-2024-1562: WooCommerce Google Sheet Connector <= 1.3.11 - Missing Authorization
The WooCommerce Google Sheet Connector plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the executepostdata function in all versions up to, and including, 1.3.11. This makes it possible for unauthenticated attackers to update plugin settings.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
WordPress plugin: WooCommerce Google Sheet Connectorto a version that resolves this vulnerability.Fixed in 1.3.11
Event History
Frequently Asked Questions
What is the severity of CVE-2024-1562?
CVE-2024-1562 has a medium severity rating, indicating that it can lead to unauthorized data modification.
How do I fix CVE-2024-1562?
To fix CVE-2024-1562, update the WooCommerce Google Sheet Connector plugin to version 1.3.12 or later.
Who is affected by CVE-2024-1562?
All users of the WooCommerce Google Sheet Connector plugin on versions up to and including 1.3.11 are affected by CVE-2024-1562.
What type of vulnerability is CVE-2024-1562?
CVE-2024-1562 is a data modification vulnerability due to missing capability checks in the plugin.
Can CVE-2024-1562 be exploited by unauthenticated users?
Yes, CVE-2024-1562 can be exploited by unauthenticated attackers to modify plugin settings.