Missing Authorization Vulnerability Affects WooCommerce Box Office
CVE-2023-34003

5.3MEDIUM

Key Information:

Vendor

WordPress
Status
WooCommerce Box Office
Vendor
CVE Published:
9 June 2024

What is CVE-2023-34003?

The WooCommerce Box Office plugin is affected by a missing authorization vulnerability that allows unauthorized users to access sensitive functionalities. This issue impacts all versions prior to 1.1.51, enabling attackers to exploit the flaw without proper authentication, leading to possible misuse of ticket-related operations and compromising user data integrity. Users of the WooCommerce Box Office plugin should take immediate action to upgrade to the latest version to mitigate potential risks associated with this vulnerability.

Affected Version(s)

WooCommerce Box Office <= 1.1.51

References

https://patchstack.com/database/vulnerability/woocommerce...
vdb-entry

CVSS V3.1

Score:
5.3
Severity:
MEDIUM
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Rafie Muhammad (Patchstack)
.