Unauthorized Data Modification in WooCommerce Plugin for WordPress

CVE-2024-11725

What is CVE-2024-11725?

The SMS Alert Order Notifications plugin for WooCommerce allows for unauthorized data modification due to a missing capability check in the updateWcWarrantySettings() function. This vulnerability impacts all versions up to 3.7.6. Authenticated attackers with a subscriber-level role can exploit this to update arbitrary options on a WordPress site, including changing user registration roles to administrator. This opens the door for unauthorized administrative access if the woocommerce-warranty plugin is installed, posing a significant risk to site security.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References