Improper Nonce Verification in Variation Swatches Plugin for WooCommerce by WordPress

CVE-2024-13511

Summary

The Variation Swatches for WooCommerce plugin suffers from improper nonce verification, allowing attackers to exploit vulnerabilities in its settings reset feature. This issue arises from the settings_init() function, which improperly handles reset actions by relying on specific URL query parameters. The faulty nonce validation carried out by the delete_settings() function exposes the plugin to potential unauthorized access, making the reset process insecure and a target for malicious actors.

References