Custom Thank You Page For Woocommerce
Monthly
Unauthenticated remote attackers can export or wipe the configuration of the Custom Thank You Page for WooCommerce WordPress plugin in all versions up to and including 1.1.2, because the save_option() function is reachable without any capability or nonce check. The issue is rated CVSS 6.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N) and is bounded to the plugin's own settings - order data and the wider WordPress site are not directly at risk - which keeps it a genuine but moderate-priority finding rather than a site-takeover bug. No public exploit code has been identified at time of analysis, and the plugin's Trac changeset suggests an upstream fix has been committed.
Unauthenticated remote attackers can export or wipe the configuration of the Custom Thank You Page for WooCommerce WordPress plugin in all versions up to and including 1.1.2, because the save_option() function is reachable without any capability or nonce check. The issue is rated CVSS 6.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N) and is bounded to the plugin's own settings - order data and the wider WordPress site are not directly at risk - which keeps it a genuine but moderate-priority finding rather than a site-takeover bug. No public exploit code has been identified at time of analysis, and the plugin's Trac changeset suggests an upstream fix has been committed.