Unauthorized Actions Possible Due to Plugin Vulnerability

CVE-2021-4444

Summary

The WooBeWoo Product Filter plugin for WordPress suffers from an authorization bypass vulnerability, primarily affecting versions up to and including 1.4.9. The vulnerability arises from insufficient authorization checks across multiple functions, enabling unauthenticated attackers to execute unauthorized actions. Exploitation of this vulnerability allows attackers to create new filters and inject malicious JavaScript code into websites using the plugin, posing significant security risks to site integrity and user safety. Immediate updates to the latest plugin version are recommended to mitigate potential threats.

References