Empik For Woocommerce
Monthly
Authenticated users with subscriber-level access or higher can alter Empik-specific WooCommerce product metadata on any store running the Empik for WooCommerce plugin up to and including version 1.5.1, because the plugin's CSV import and product/offer import handlers execute without verifying user capabilities. The missing authorization check (CWE-862) allows modification of the _empik_logistic_klass, _empik_product_state, _empik_product_state_all_variants, and export/offer flag fields on arbitrary products, producing an integrity-only impact scored at CVSS 4.3 with no confidentiality or availability effect and no code execution. No public exploit has been identified at the time of analysis; exposure is greatest on sites with open user registration, where any self-registered subscriber account is sufficient to reach the vulnerable endpoints.
Authenticated users with subscriber-level access or higher can alter Empik-specific WooCommerce product metadata on any store running the Empik for WooCommerce plugin up to and including version 1.5.1, because the plugin's CSV import and product/offer import handlers execute without verifying user capabilities. The missing authorization check (CWE-862) allows modification of the _empik_logistic_klass, _empik_product_state, _empik_product_state_all_variants, and export/offer flag fields on arbitrary products, producing an integrity-only impact scored at CVSS 4.3 with no confidentiality or availability effect and no code execution. No public exploit has been identified at the time of analysis; exposure is greatest on sites with open user registration, where any self-registered subscriber account is sufficient to reach the vulnerable endpoints.