Unauthorized Data Modification Vulnerability in MWB HubSpot for WooCommerce by MakeWebBetter
CVE-2024-10591
8.8HIGH
Key Information:
- Vendor
- WordPress
- Status
- Vendor
- CVE Published:
- 30 January 2025
Summary
The MWB HubSpot for WooCommerce plugin for WordPress possesses a vulnerability that allows unauthorized modification of data. This arises due to the absence of capability checks within the hubwoo_save_updates() function. Consequentially, authenticated attackers with Contributor-level access or higher have the potential to update arbitrary site options. This exploitation can facilitate privilege escalation, allowing attackers to modify user registration roles and gain administrative access to the affected WordPress site.
Affected Version(s)
MWB HubSpot for WooCommerce – CRM, Abandoned Cart, Email Marketing, Marketing Automation & Analytics * <= 1.5.9
References
CVSS V3.1
Score:
8.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged
Timeline
Vulnerability published
Vulnerability Reserved
Credit
AmrAwad