CVE-2024-10853
CVSS 3.1 Score 4.3 of 10 (medium)
Details
Published Nov 13, 2024
CWE ID 862
Summary
CVE-2024-10853 is a vulnerability affecting the Buy one click WooCommerce plugin for WordPress. The issue stems from a missing capability check on the removeorder AJAX action, which exists in all versions up to 2.2.9. This flaw allows authenticated attackers, with Subscriber-level access and above, to unauthorizedly modify data by deleting Buy one click WooCommerce orders. This vulnerability poses a significant risk, particularly for WordPress sites utilizing this plugin, and requiring an immediate update to the latest, secure version.
Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.