WooCommerce upsell plugin missing access checks
A WordPress shop add-on plugin lets people without permission change settings.
Summary
The Upsell Order Bump Offer for WooCommerce WordPress plugin lacks proper authorization checks. Sites running version 3.1.6 or older are affected.
Affected when
- Upsell Order Bump Offer for WooCommerce 3.1.6 or older
What to do
No source gives a fixed version. Check that the installed plugin is newer than 3.1.6 and read the vendor's advisory.
Products and platforms
CVE IDs
Sources
- CVE record: cve.org (opens in a new tab)
Times
First published
First seen