Productive Commerce
Monthly
Authenticated subscribers on WordPress sites running the Productive Commerce plugin before 1.1.49 can activate any plugin already installed on the site, because one of its AJAX actions omits a capability check and the nonce meant to guard it is exposed on every admin-area page. The flaw is a moderate, integrity-only authorization issue (CVSS 4.3, AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) that requires a logged-in account and cannot be used to upload new plugins. Publicly available exploit code exists, and the vendor has released version 1.1.49 to address it.
Authenticated subscribers on WordPress sites running the Productive Commerce plugin before 1.1.49 can activate any plugin already installed on the site, because one of its AJAX actions omits a capability check and the nonce meant to guard it is exposed on every admin-area page. The flaw is a moderate, integrity-only authorization issue (CVSS 4.3, AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) that requires a logged-in account and cannot be used to upload new plugins. Publicly available exploit code exists, and the vendor has released version 1.1.49 to address it.