Vulnerabilities > CVE-2024-1686 - Missing Authorization vulnerability in Villatheme Woocommerce Thank YOU Page Customizer

047910
CVSS 6.5 - MEDIUM
Attack vector
NETWORK
Attack complexity
LOW
Privileges required
LOW
Confidentiality impact
HIGH
Integrity impact
NONE
Availability impact
NONE
network
low complexity
villatheme
CWE-862
NVD
Published: 2024-02-27
Updated: 2025-01-15

Summary

The Thank You Page Customizer for WooCommerce – Increase Your Sales plugin for WordPress is vulnerable to missing authorization e in all versions up to, and including, 1.1.2 via the apply_layout function due to a missing capability check. This makes it possible for authenticated attackers, with subscriber-level access and above, to retrieve arbitrary order data which may contain PII.

Vulnerable Configurations

Part Description Count
Application
Villatheme
1

Common Weakness Enumeration (CWE)

References