CVE-2024-3243: Customer Reviews for WooCommerce <= 5.46.0 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Email Sending
The Customer Reviews for WooCommerce plugin for WordPress is vulnerable to unauthorized email sending due to a missing capability check on the sendtestemail() function in all versions up to, and including, 5.46.0. This makes it possible for authenticated attackers, with subscriber-level access and above, to send arbitrary test emails.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2024-3243?
CVE-2024-3243 is considered a moderate severity vulnerability due to its potential for unauthorized email sending.
How do I fix CVE-2024-3243?
To fix CVE-2024-3243, update the Customer Reviews for WooCommerce plugin to version 5.47.0 or later.
Who is affected by CVE-2024-3243?
CVE-2024-3243 affects all users of the Customer Reviews for WooCommerce plugin for WordPress versions up to and including 5.46.0.
What is the impact of CVE-2024-3243?
The impact of CVE-2024-3243 is that authenticated attackers with subscriber-level access can send unauthorized emails.
Is there a workaround for CVE-2024-3243 before updating?
A temporary workaround for CVE-2024-3243 is to restrict subscriber-level access or disable the plugin until an update is applied.