CVE-2024-13424

Vulnerability

The Ni Sales Commission For WooCommerce plugin for WordPress (ni-woo-sales-commission) versions up to and including 1.2.4 contains a missing capability check on the niwoosc_ajax AJAX endpoint. This flaw permits authenticated attackers with at least Subscriber-level access to update the plugin's settings and modify commission amounts, without the required administrative privileges.

Exploitation

An attacker needs a valid WordPress account with Subscriber-level access or higher. By sending a crafted AJAX request to the niwoosc_ajax endpoint, the attacker can bypass authorization checks due to the missing capability verification. No additional authentication or user interaction is required beyond the existing session.

Impact

Successful exploitation allows an attacker to alter commission amounts and other plugin settings. This can lead to unauthorized financial modifications, potentially enabling the attacker to inflate commissions or disrupt the intended sales commission structure. The scope is limited to settings controlled by the plugin; however, no direct file disclosure, remote code execution, or privilege escalation is reported.

Mitigation

The plugin has been closed and removed from the WordPress.org plugin directory as of January 30, 2025, due to a security issue [1]. No official patch has been released for versions up to 1.2.4. Users should uninstall the plugin immediately and seek alternative solutions [1]. There is no known workaround.