CVE-2024-9189: EU/UK VAT Manager for WooCommerce <= 2.12.12 - Missing Authorization
The EU/UK VAT Manager for WooCommerce plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the algwceuvatexemptvatfromadmin() function in all versions up to, and including, 2.12.12. This makes it possible for unauthenticated attackers to update the VAT status for any order.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2024-9189?
CVE-2024-9189 has a medium severity due to the potential for unauthorized data modification.
How do I fix CVE-2024-9189?
To fix CVE-2024-9189, update the Wpfactory EU/UK VAT Manager for WooCommerce plugin to version 2.12.14 or later.
What versions are affected by CVE-2024-9189?
CVE-2024-9189 affects all versions of the Wpfactory EU/UK VAT Manager for WooCommerce up to and including 2.12.12.
What type of vulnerability is CVE-2024-9189?
CVE-2024-9189 is a vulnerability that allows unauthorized modification of data due to a missing capability check.
Who is affected by CVE-2024-9189?
Users of the Wpfactory EU/UK VAT Manager for WooCommerce plugin on WordPress are affected by CVE-2024-9189.