Unauthorized Data Access in Print Labels with Barcodes for WooCommerce Plugin
CVE-2024-1677

8.8HIGH

Key Information:

Vendor

Wordpress
Status
Print Labels With Barcodes. Create Price Tags, Product Labels, Order Labels For WooCommerce
Vendor
CVE Published:
2 May 2024

What is CVE-2024-1677?

The Print Labels with Barcodes for WooCommerce plugin is susceptible to unauthorized data access and modifications due to inadequate capability checks on 42 distinct AJAX functions. This flaw affects all versions up to and including 3.4.6, allowing attackers with subscriber roles or higher to manipulate plugin settings, manage profiles, and perform actions on templates and barcode data. This situation significantly heightens the risk of data loss and tampering, necessitating immediate attention from users to secure their installations.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch

Affected Version(s)

Print Labels with Barcodes. Create price tags, product labels, order labels for WooCommerce * <= 3.4.6

References

https://www.wordfence.com/threat-intel/vulnerabilities/id...
https://plugins.trac.wordpress.org/browser/a4-barcode-gen...

CVSS V3.1

Score:
8.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Lucio Sá
JSON
.