CVE-2024-9927
WooCommerce Order Proposal <= 2.0.5 - Authenticated (Shop Manager+) Privilege Escalation via Order Proposal
We use these services and cookies to improve your user experience. You may opt out if you wish, however, this may limit some features on this site.
Please see our statement on Data Privacy.
WooCommerce Order Proposal <= 2.0.5 - Authenticated (Shop Manager+) Privilege Escalation via Order Proposal
The WooCommerce Order Proposal plugin for WordPress is vulnerable to privilege escalation via order proposal in all versions up to and including 2.0.5. This is due to the improper implementation of allow_payment_without_login function. This makes it possible for authenticated attackers, with Shop Manager-level access and above, to log in to WordPress as an arbitrary user account, including administrators.
Reserved 2024-10-14 | Published 2024-10-23 | Updated 2024-10-23 | Assigner WordfenceCWE-287 Improper Authentication
| 2024-08-24: | Discovered |
| 2024-10-22: | Disclosed |
Theo Papaioannou
www.wordfence.com/...-6f65-4570-811c-13a80dbec064?source=cve
wpovernight.com/downloads/woocommerce-order-proposal/
Support options
