CVE-2024-12266

Summary

CVE-2024-12266 is a vulnerability affecting the ELEX WooCommerce Dynamic Pricing and Discounts plugin for WordPress. Unauthenticated attackers can exploit this issue by importing and exporting product rules due to a missing capability check on the elex_dp_export_rules() and elex_dp_import_rules() functions. This vulnerability, present in all versions up to 2.1.7, also grants attackers access to sensitive phpinfo() data. The impact of this issue includes unauthorized data access, making it crucial for users to update their plugin to a secure version promptly.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.