CVE-2024-0617

The Category Discount Woocommerce plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the wpcd_save_discount() function in all versions up to, and including, 4.12. This makes it possible for unauthenticated attackers to modify product category discounts that could lead to loss of revenue.

More information : https://plugins.trac.wordpress.org/browser/woo-product-category-discount/trunk/cd-admin.php#L171

Attack vector : NETWORK
Attack complexity : LOW
Privileges required : NONE
User interaction : NONE
Confidentiality impact : NONE
Integrity impact : LOW
Base score : 5.3
Base severity : MEDIUM
Exploitability score : 3.9
Impact score : 1.4