Unauthorized Data Access in ELEX WooCommerce Pricing Plugin for WordPress

CVE-2024-12266

What is CVE-2024-12266?

The ELEX WooCommerce Dynamic Pricing and Discounts plugin for WordPress exposes sensitive data to unauthorized users due to inadequate capability checks within the elex_dp_export_rules() and elex_dp_import_rules() functions. This vulnerability affects all versions up to and including 2.1.7, allowing unauthenticated attackers to gain unauthorized access, import and export product rules, and potentially access phpinfo() data. Website owners using this plugin should take immediate action to secure their installations and implement the necessary updates or patches recommended by the vendor to mitigate this risk.

References