WordPress security changelog
MEDIUM CVE-2023-37971 Deferred

WooCommerce Product Stock Alert: A security weakness

WooCommerce Product Stock Alert is affected by a security weakness. Exposure depends on how the affected operation is made reachable by the site. The resulting impact depends on how the affected component exposes the vulnerable operation.

CVE / CNA score 6.5 CVSS 3.1 · audit@patchstack.com
NVD score Pending NVD has not published its own CVSS assessment.
Component
WooCommerce Product Stock Alert
Plugin slug
woocommerce-product-stock-alert
Affected
See vendor advisory
Safe version
See mitigation notes
Published
Dec 13, 2024
Weakness
CWE-862 — Missing Authorization

This CVE was published Dec 13, 2024 and is one of 3 known issues for this plugin.

What to do

Patch or disable the affected component.

Update WooCommerce Product Stock Alert to a release outside the affected range, or disable and remove it until a fixed version is available.

Source record

Technical description

Missing Authorization vulnerability in MultiVendorX WooCommerce Product Stock Alert allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WooCommerce Product Stock Alert: from n/a through 2.0.1.

CVE / CNA vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L

References

Primary and upstream sources