WooCommerce Discount Rules Vulnerable to Missing Authorization

CVE-2020-36834

What is CVE-2020-36834?

The Discount Rules for WooCommerce plugin used in WordPress environments exhibits a critical authorization flaw through multiple AJAX actions. The vulnerability exists in versions up to and including 2.0.2, where a lack of proper capability checks allows subscriber-level attackers to exploit the system. This oversight permits unauthorized individuals to modify discount rules and save configurations, thereby affecting the integrity of the e-commerce setup and potentially leading to unauthorized transactions or data manipulation.

References