Unauthorized Access Exploit in WC Price History Plugin for WordPress

CVE-2024-12617

Summary

The WC Price History for Omnibus plugin utilized in WordPress has a significant security flaw that allows unauthorized access due to inadequate capability checks on several AJAX actions. This vulnerability affects all versions up to and including 2.1.3, enabling authenticated attackers with Subscriber-level access and above to view and even modify sensitive history data. The lack of proper validation mechanisms opens avenues for potential exploitation, making it crucial for site administrators to take prompt action to secure their installations.

References