Unauthorized Access Exploit in WC Price History Plugin for WordPress

CVE-2024-12617

What is CVE-2024-12617?

The WC Price History for Omnibus plugin utilized in WordPress has a significant security flaw that allows unauthorized access due to inadequate capability checks on several AJAX actions. This vulnerability affects all versions up to and including 2.1.3, enabling authenticated attackers with Subscriber-level access and above to view and even modify sensitive history data. The lack of proper validation mechanisms opens avenues for potential exploitation, making it crucial for site administrators to take prompt action to secure their installations.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References