CVE-2024-1862: WooCommerce Add to Cart Custom Redirect <= 1.2.13 - Authenticated(Contributor+) Missing Authorization to Limited Arbitrary Options Update
The WooCommerce Add to Cart Custom Redirect plugin for WordPress is vulnerable to unauthorized modification of data and loss of data due to a missing capability check on the 'wcrdismissadminnotice' function in all versions up to, and including, 1.2.13. This makes it possible for authenticated attackers, with contributor access and above, to update the values of arbitrary site options to 'dismissed'.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2024-1862?
CVE-2024-1862 has a high severity due to the potential for unauthorized data modification and loss.
How do I fix CVE-2024-1862?
To fix CVE-2024-1862, upgrade the WooCommerce Add to Cart Custom Redirect plugin to version 1.2.14 or newer.
Who is affected by CVE-2024-1862?
Users of the WooCommerce Add to Cart Custom Redirect plugin versions up to 1.2.13 are affected by CVE-2024-1862.
What causes the vulnerability in CVE-2024-1862?
The vulnerability in CVE-2024-1862 is caused by a missing capability check in the 'wcr_dismiss_admin_notice' function.
Is CVE-2024-1862 an exploit that requires authentication?
Yes, CVE-2024-1862 requires authentication to exploit, allowing unauthorized users to modify or lose data.