CVE-2023-27607

Vulnerability

The Points and Rewards for WooCommerce plugin for WordPress suffers from a missing authorization vulnerability in versions up to and including 1.5.0. This flaw allows attackers to alter plugin settings without proper permission checks, as the underlying code does not verify the user's capabilities before processing certain requests [1].

Exploitation

Exploitation requires no authentication, making it accessible to any unauthenticated attacker who can send crafted HTTP requests to the vulnerable endpoints. The attack complexity is low, and the vulnerability can be leveraged remotely over the network [1].

Impact

Successful exploitation enables an attacker to change the plugin's settings arbitrarily, potentially disrupting the rewards system, modifying award conditions, or introducing other misconfigurations. The CVSS v3 base score is 5.4 (Medium), with the main impacts on integrity (partial) without compromising confidentiality or availability directly [1].

Mitigation

The vendor has not released a patch; users are advised to update the plugin or apply workarounds. Given that similar vulnerabilities are targeted in mass-exploit campaigns, immediate action is recommended, such as disabling the plugin until a fix is applied [1].