CVE-2024-24711

WordPress WooCommerce Conversion Tracking plugin <= 2.0.11 - Broken Access Control vulnerability

Severity Score

4.3

*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

*Multiple Sources

Exploited in Wild

*KEV

Decision

Attend

*SSVC

Descriptions

Missing Authorization vulnerability in weDevs WooCommerce Conversion Tracking.This issue affects WooCommerce Conversion Tracking: from n/a through 2.0.11.

Vulnerabilidad de autorización faltante en el seguimiento de conversiones de WooCommerce de weDevs. Este problema afecta al seguimiento de conversiones de WooCommerce: desde n/a hasta 2.0.11.

The WooCommerce Conversion Tracking plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'wcct_install_happy_addons' function in versions up to and including 2.0.11. This makes it possible for authenticated attackers, with subscriber access and above, to install the Happy Elementor Addons plugin.

*Credits: Abdi Pranata (Patchstack Alliance)

CVSS Scores

Patchstackv3.1 4.3

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

* Common Vulnerability Scoring System

SSVC

Decision:Attend

Exploitation

None

Automatable

Yes

Tech. Impact

Partial

* Organization's Worst-case Scenario

Timeline

2024-01-26 CVE Reserved
2024-01-31 CVE Published
2024-03-27 EPSS Updated
2024-08-02 CVE Updated
---------- Exploited in Wild
---------- KEV Due Date
---------- First Exploit

CWE

CWE-862: Missing Authorization

CAPEC

References (1)

URL	Tag	Source
https://patchstack.com/database/vulnerability/woocommerce-conversion-tracking/wordpress-woocommerce-conversion-tracking-plugin-2-0-11-broken-access-control-csrf-vulnerability?_s_id=cve	Vdb Entry

URL	Date	SRC

URL	Date	SRC

URL	Date	SRC

Affected Vendors, Products, and Versions

Vendor		Product				Version		Other		Status
Vendor	Product	Version	Other	Status	<-- -->	Vendor	Product	Version	Other	Status
Woocommerce Conversion Tracking Search vendor "Woocommerce Conversion Tracking"		Woocommerce Conversion Tracking Search vendor "Woocommerce Conversion Tracking" for product "Woocommerce Conversion Tracking"				>= 0.0.0 <= 2.0.11 Search vendor "Woocommerce Conversion Tracking" for product "Woocommerce Conversion Tracking" and version " >= 0.0.0 <= 2.0.11"		en		Affected