CVE-2024-1639: License Manager for WooCommerce <= 3.0.7 - Improper Authorization to Authenticated(Contributor+) Sensitive Information Exposure
First published: Fri Jun 21 2024(Updated: )
The License Manager for WooCommerce plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the showLicenseKey() and showAllLicenseKeys() functions in all versions up to, and including, 3.0.7. This makes it possible for authenticated attackers, with admin dashboard access (contributors by default due to WooCommerce) to view arbitrary decrypted license keys. The functions contain a referrer nonce check. However, these can be retrieved via the dashboard through the "license" JS variable.
Credit: security@wordfence.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Wpexperts License Manager For Woocommerce Wordpress | <=3.0.7 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2024-1639?
CVE-2024-1639 is considered a medium severity vulnerability due to the potential unauthorized access to sensitive data.
How do I fix CVE-2024-1639?
To fix CVE-2024-1639, update the License Manager for WooCommerce plugin to version 3.0.8 or higher.
What versions are affected by CVE-2024-1639?
CVE-2024-1639 affects all versions of the License Manager for WooCommerce plugin up to and including version 3.0.7.
Who is impacted by CVE-2024-1639?
Users of the License Manager for WooCommerce plugin who have not updated to version 3.0.8 or higher are impacted by CVE-2024-1639.
What exploits are associated with CVE-2024-1639?
CVE-2024-1639 allows authenticated attackers to access license key information without proper permissions.
- agent/title
- agent/references
- agent/type
- agent/description
- agent/first-publish-date
- agent/severity
- agent/author
- agent/event
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/weakness
- agent/softwarecombine
- agent/source
- agent/tags
- collector/nvd-api
- source/NVD
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- vendor/wpexperts
- canonical/wpexperts license manager for woocommerce
- version/wpexperts license manager for woocommerce/3.0.7