Sku Error Fixer For Woocommerce
Monthly
Unauthenticated attackers can permanently delete product variations and read their details on WooCommerce stores running the SKU Error Fixer for WooCommerce plugin through version 1.0, because two of the plugin's AJAX actions lack both capability and nonce checks. Publicly available exploit code exists, and the deletions leave no recoverable copy behind, although the impact is scoped to variations the plugin itself classifies as obsolete rather than arbitrary products or site data. EPSS is low at 0.14% (3rd percentile) and there is no confirmed active exploitation (CISA KEV), so this rates as genuine but low-priority.
Unauthenticated attackers can permanently delete product variations and read their details on WooCommerce stores running the SKU Error Fixer for WooCommerce plugin through version 1.0, because two of the plugin's AJAX actions lack both capability and nonce checks. Publicly available exploit code exists, and the deletions leave no recoverable copy behind, although the impact is scoped to variations the plugin itself classifies as obsolete rather than arbitrary products or site data. EPSS is low at 0.14% (3rd percentile) and there is no confirmed active exploitation (CISA KEV), so this rates as genuine but low-priority.