Authenticated Attackers Can Delete Plugin's API Key Due to Missing Capability Check

CVE-2024-9109

What is CVE-2024-9109?

The WooCommerce UPS Shipping – Live Rates and Access Points plugin for WordPress contains a vulnerability that permits unauthorized modification of sensitive data. This flaw arises from a missing capability check on the delete_oauth_data function, allowing authenticated attackers with Subscriber-level access and above to delete the plugin's API key. Exploitation of this vulnerability could lead to serious security risks, including unauthorized access to shipping functionalities and potential service disruptions.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References