4.3 Medium

CVE-2024-12826 The GoHero Store Customizer for WooCommerce plugin for WordPress is vulnerable to unauthorized modification of data…

Description

The GoHero Store Customizer for WooCommerce plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the wooh_action_settings_save_frontend() function in all versions up to, and including, 3.5. This makes it possible for unauthenticated attackers to update limited plugin settings.

Affected products and versions

Product	Affected versions	Fixed in
GoHero Store Customizer for WooCommerce 3.5	earliest → 3.5	No fix stated

Do you use GoHero Store Customizer for WooCommerce?

Track this CVE Watch GoHero Store Customizer for WooCommerce Check my SBOMs

www.cveye.io/en/cve/CVE-2024-12826

Timeline

Published January 25, 2025
Last modified April 8, 2026

References

www.wordfence.com www.wordfence.com
wordpress.org wordpress.org
plugins.trac.wordpress.org plugins.trac.wordpress.org

Track this CVE