CVE-2023-47694

The Mini Cart Drawer For WooCommerce plugin for WordPress contains a missing authorization vulnerability, classified as a broken access control issue. Versions through 4.0.0 fail to properly enforce access controls, allowing unprivileged users to execute functions that should require higher privileges [1].

Exploitation requires a privileged user to perform an action, such as clicking a malicious link, visiting a crafted page, or submitting a form. This user interaction is necessary for the attack to succeed, meaning the vulnerability is not directly exploitable by unauthenticated attackers [1].

If successfully exploited, an attacker with lower privileges can perform actions reserved for higher-privileged users, potentially leading to unauthorized modifications or data exposure within the WooCommerce environment [1].

The vulnerability has been addressed in version 4.0.1 of the plugin. Users are strongly advised to update immediately. Patchstack users can enable auto-updates for vulnerable plugins to ensure protection [1].