Unauthorized Data Submission in NextMove Lite – Thank You Page for WooCommerce Plugin by WordPress

CVE-2024-10860

Summary

The NextMove Lite – Thank You Page for WooCommerce plugin for WordPress has a security issue that allows authenticated attackers with Subscriber-level access or higher to submit a deactivation reason without appropriate checks in place. This vulnerability arises from the absence of a capability verification in the _submit_uninstall_reason_action() function, affecting all versions up to 2.19.0. Site owners must take immediate action to secure their installations and prevent unauthorized data submissions, which could compromise site integrity.

References