Ilghera Reviso Exporter For Woocommerce
Monthly
Unauthorized token deletion in the Reviso Exporter for WooCommerce WordPress plugin (≤1.2.3) allows any authenticated subscriber-level user to permanently delete the plugin's stored Reviso Agreement Grant Token via an unprotected AJAX action, severing the WooCommerce-to-Reviso accounting service integration. The vulnerability stems from the `disconnect_callback()` function registered to `wp_ajax_wcefr-disconnect` performing no capability check and no nonce verification, meaning any logged-in WordPress user - including those with the lowest default role - can trigger it. No public exploit code is identified at time of analysis, and a vendor-released patch exists as of version 1.2.4.
Unauthorized token deletion in the Reviso Exporter for WooCommerce WordPress plugin (≤1.2.3) allows any authenticated subscriber-level user to permanently delete the plugin's stored Reviso Agreement Grant Token via an unprotected AJAX action, severing the WooCommerce-to-Reviso accounting service integration. The vulnerability stems from the `disconnect_callback()` function registered to `wp_ajax_wcefr-disconnect` performing no capability check and no nonce verification, meaning any logged-in WordPress user - including those with the lowest default role - can trigger it. No public exploit code is identified at time of analysis, and a vendor-released patch exists as of version 1.2.4.