Morning For Woocommerce
Monthly
Unauthenticated broken access control in Morning for WooCommerce (plugin slug wc-gateway-greeninvoice) 2.4.1 and earlier allows remote attackers to reach plugin functionality that should require authorization, undermining the integrity of the store's invoicing/gateway data. The assessed CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N, 7.5 High) confirms the flaw is network-reachable with no credentials and no user interaction, while bounding impact to integrity alone - no confidentiality or availability effect is assessed. Exposure is confined to WooCommerce stores that specifically deploy this Green Invoice/Morning gateway plugin; no public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV.
Unauthenticated broken access control in Morning for WooCommerce (plugin slug wc-gateway-greeninvoice) 2.4.1 and earlier allows remote attackers to reach plugin functionality that should require authorization, undermining the integrity of the store's invoicing/gateway data. The assessed CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N, 7.5 High) confirms the flaw is network-reachable with no credentials and no user interaction, while bounding impact to integrity alone - no confidentiality or availability effect is assessed. Exposure is confined to WooCommerce stores that specifically deploy this Green Invoice/Morning gateway plugin; no public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV.