CVE-2024-1686

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2024-1686
The Thank You Page Customizer for WooCommerce – Increase Your Sales plugin for WordPress is vulnerable to missing authorization e in all versions up to, and including, 1.1.2 via the apply_layout function due to a missing capability check. This makes it possible for authenticated attackers, with subscriber-level access and above, to retrieve arbitrary order data which may contain PII.

5.3 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References
Link Resource
https://plugins.trac.wordpress.org/changeset/3041096/woo-thank-you-page-customizer/trunk/frontend/frontend.php Patch
https://www.wordfence.com/threat-intel/vulnerabilities/id/2e7ebc0c-6936-4632-a602-7131c7d8bd6a?source=cve Third Party Advisory
https://plugins.trac.wordpress.org/changeset/3041096/woo-thank-you-page-customizer/trunk/frontend/frontend.php Patch
https://www.wordfence.com/threat-intel/vulnerabilities/id/2e7ebc0c-6936-4632-a602-7131c7d8bd6a?source=cve Third Party Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:villatheme:woocommerce_thank_you_page_customizer:*:*:*:*:free:wordpress:*:*
History

15 Jan 2025, 19:51

Type Values Removed Values Added
References () https://plugins.trac.wordpress.org/changeset/3041096/woo-thank-you-page-customizer/trunk/frontend/frontend.php - () https://plugins.trac.wordpress.org/changeset/3041096/woo-thank-you-page-customizer/trunk/frontend/frontend.php - Patch
References () https://www.wordfence.com/threat-intel/vulnerabilities/id/2e7ebc0c-6936-4632-a602-7131c7d8bd6a?source=cve - () https://www.wordfence.com/threat-intel/vulnerabilities/id/2e7ebc0c-6936-4632-a602-7131c7d8bd6a?source=cve - Third Party Advisory
CPE cpe:2.3:a:villatheme:woocommerce_thank_you_page_customizer:*:*:*:*:free:wordpress:*:*
CWE CWE-862
First Time Villatheme
Villatheme woocommerce Thank You Page Customizer

21 Nov 2024, 08:51

Type Values Removed Values Added
References () https://plugins.trac.wordpress.org/changeset/3041096/woo-thank-you-page-customizer/trunk/frontend/frontend.php - () https://plugins.trac.wordpress.org/changeset/3041096/woo-thank-you-page-customizer/trunk/frontend/frontend.php -
References () https://www.wordfence.com/threat-intel/vulnerabilities/id/2e7ebc0c-6936-4632-a602-7131c7d8bd6a?source=cve - () https://www.wordfence.com/threat-intel/vulnerabilities/id/2e7ebc0c-6936-4632-a602-7131c7d8bd6a?source=cve -

27 Feb 2024, 14:20

Type Values Removed Values Added
Summary
  • (es) El complemento Thank You Page Customizer for WooCommerce – Increase Your Sales para WordPress, es vulnerable a la falta de autorización e en todas las versiones hasta la 1.1.2 incluida, a través de la función apply_layout debido a una verificación de capacidad faltante. Esto hace posible que atacantes autenticados, con acceso a nivel de suscriptor y superior, recuperen datos de pedidos arbitrarios que pueden contener PII.

27 Feb 2024, 06:15

Type Values Removed Values Added
New CVE
Information

Published : 2024-02-27 06:15

Updated : 2025-01-15 19:51

NVD link : CVE-2024-1686

Mitre link : CVE-2024-1686

CVE.ORG link : CVE-2024-1686

JSON object : View

Products Affected

villatheme

  • woocommerce_thank_you_page_customizer
CWE
CWE-862

Missing Authorization