Unauthorized Data Modification Vulnerability in MWB HubSpot for WooCommerce by MakeWebBetter
CVE-2024-10591
8.8HIGH
Key Information:
- Vendor
WordPress
- Status
- Vendor
- CVE Published:
- 30 January 2025
What is CVE-2024-10591?
The MWB HubSpot for WooCommerce plugin for WordPress possesses a vulnerability that allows unauthorized modification of data. This arises due to the absence of capability checks within the hubwoo_save_updates() function. Consequentially, authenticated attackers with Contributor-level access or higher have the potential to update arbitrary site options. This exploitation can facilitate privilege escalation, allowing attackers to modify user registration roles and gain administrative access to the affected WordPress site.
Affected Version(s)
MWB HubSpot for WooCommerce – CRM, Abandoned Cart, Email Marketing, Marketing Automation & Analytics * <= 1.5.9