Product Sets Plugin
Monthly
Missing authorization in the Datafeedr Product Sets plugin for WordPress (versions up to and including 1.3.24) allows any logged-in user to delete saved searches they do not own. The AJAX handler dfrps_ajax_delete_saved_search in functions/ajax.php performs no capability check (CWE-862), so an attacker only needs a low-privilege account on the target site-no administrative role is required-to trigger unauthorized state changes. Impact is limited to low integrity and availability (no confidentiality exposure), reflected in the 2.1 CVSS v4.0 score and the assessed CVSS 3.1 vector of AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L; the vulnerability is fixed in 1.3.25, the disclosure states public exploit code exists, and the current priority decision is monitor rather than emergency.
Missing authorization in the Datafeedr Product Sets plugin for WordPress (versions up to and including 1.3.24) allows any logged-in user to delete saved searches they do not own. The AJAX handler dfrps_ajax_delete_saved_search in functions/ajax.php performs no capability check (CWE-862), so an attacker only needs a low-privilege account on the target site-no administrative role is required-to trigger unauthorized state changes. Impact is limited to low integrity and availability (no confidentiality exposure), reflected in the 2.1 CVSS v4.0 score and the assessed CVSS 3.1 vector of AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L; the vulnerability is fixed in 1.3.25, the disclosure states public exploit code exists, and the current priority decision is monitor rather than emergency.