Unauthorized Order Modification Vulnerability in Buy one Click WooCommerce Plugin

CVE-2024-10853

Summary

The Buy One Click WooCommerce Plugin for WordPress contains a vulnerability that permits unauthorized modification of order data. This issue arises from a lack of proper capability checks on the removeorder AJAX action, affecting all versions up to and including 2.2.9. Authenticated attackers with Subscriber-level access and higher can exploit this flaw to delete WooCommerce orders without appropriate authorization. Such vulnerabilities highlight the importance of implementing stringent access controls and regular updates to safeguard against potential data breaches.

References