Yith Woocommerce Product Bundles
Monthly
Missing authorization in YITH WooCommerce Product Bundles through 2.29.0 lets unauthenticated remote attackers invoke access-controlled plugin functionality and perform a limited, low-integrity action on WordPress/WooCommerce sites running the plugin. The CVSS 3.1 score is 5.3 (AV:N/AC:L/PR:N/UI:N) with no confidentiality or availability impact; no public exploit was identified at time of analysis, and there is no CISA KEV entry.
Missing authorization controls in the YITH WooCommerce Product Bundles plugin for WordPress (versions through 2.29.0) allow unauthenticated remote attackers to perform bundle-related actions they should not be permitted to perform on sites where the plugin is installed and active. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N, base 5.3) confirms that no credentials or user interaction are required, but the impact is bounded to a low-integrity effect - there is no confidentiality or availability impact - and the store must actually run the affected plugin for exposure. At the time of analysis there is no vendor-released patch identified and no public exploit code identified; exploitation is limited to network reachability of the vulnerable endpoint on a WooCommerce store with the bundle feature enabled.
plugin-fw/lib/yit-plugin-panel-wc.php in the YIT Plugin Framework through 3.3.8 for WordPress allows authenticated options changes. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Missing authorization in YITH WooCommerce Product Bundles through 2.29.0 lets unauthenticated remote attackers invoke access-controlled plugin functionality and perform a limited, low-integrity action on WordPress/WooCommerce sites running the plugin. The CVSS 3.1 score is 5.3 (AV:N/AC:L/PR:N/UI:N) with no confidentiality or availability impact; no public exploit was identified at time of analysis, and there is no CISA KEV entry.
Missing authorization controls in the YITH WooCommerce Product Bundles plugin for WordPress (versions through 2.29.0) allow unauthenticated remote attackers to perform bundle-related actions they should not be permitted to perform on sites where the plugin is installed and active. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N, base 5.3) confirms that no credentials or user interaction are required, but the impact is bounded to a low-integrity effect - there is no confidentiality or availability impact - and the store must actually run the affected plugin for exposure. At the time of analysis there is no vendor-released patch identified and no public exploit code identified; exploitation is limited to network reachability of the vulnerable endpoint on a WooCommerce store with the bundle feature enabled.
plugin-fw/lib/yit-plugin-panel-wc.php in the YIT Plugin Framework through 3.3.8 for WordPress allows authenticated options changes. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.