CVE-2020-36834 | THREATINT

We use these services and cookies to improve your user experience. You may opt out if you wish, however, this may limit some features on this site.

Please see our statement on Data Privacy.

Crisp.chat (Helpdesk and Chat)

Ok

Description

The Discount Rules for WooCommerce plugin for WordPress is vulnerable to missing authorization via several AJAX actions in versions up to, and including, 2.0.2 due to missing capability checks on various functions. This makes it possible for subscriber-level attackers to execute various actions and perform a wide variety of actions such as modifying rules and saving configurations.

Reserved 2024-10-15 | Published 2024-10-16 | Updated 2024-10-16 | Assigner Wordfence

MEDIUM: 6.3CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

Problem types

CWE-862 Missing Authorization

Product status

Default status

unaffected

*

affected

Timeline

2020-08-07:	Discovered
2020-08-07:	Vendor Notified
2020-08-20:	Disclosed

Credits

Patchstack finder

References

www.wordfence.com/...-a01b-4e34-9584-b1d3fc87af34?source=cve

patchstack.com/...-in-discount-rules-for-woocommerce-plugin/

cve.org (CVE-2020-36834)

nvd.nist.gov (CVE-2020-36834)

Download JSON

https://cve.threatint.com/CVE/CVE-2020-36834

Support options

Helpdesk Chat, Email, Knowledgebase
Telegram Chat

Subscribe to our newsletter to learn more about our work.