Authorization Bypass in XforWooCommerce Add-On Plugins for WordPress

CVE-2021-4337

Summary

Multiple XforWooCommerce Add-On Plugins for WordPress have a vulnerability due to a missing capability check on the wp_ajax_svx_ajax_factory function. This flaw allows authenticated attackers with subscriber-level permissions and above to manipulate WordPress settings and plugin configurations. Attackers can gain unauthorized access to sensitive data, edit existing settings, or delete critical WordPress configurations. The affected plugins include several widely used WooCommerce add-ons, making it crucial for site administrators to update to patched versions to mitigate the risk.

References