Authenticated Attackers Can Delete Plugin's API Key Due to Missing Capability Check

CVE-2024-9109

What is CVE-2024-9109?

The WooCommerce UPS Shipping – Live Rates and Access Points plugin for WordPress contains a vulnerability that permits unauthorized modification of sensitive data. This flaw arises from a missing capability check on the delete_oauth_data function, allowing authenticated attackers with Subscriber-level access and above to delete the plugin's API key. Exploitation of this vulnerability could lead to serious security risks, including unauthorized access to shipping functionalities and potential service disruptions.

References