Skip to content
Sign in
5.3 Medium

CVE-2024-0870 The YITH WooCommerce Gift Cards plugin for WordPress is vulnerable to unauthorized modification of data due to a missing…

Description

The YITH WooCommerce Gift Cards plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'save_mail_status' and 'save_email_settings' functions in all versions up to, and including, 4.12.0. This makes it possible for unauthenticated attackers to modify WooCommerce settings.

Affected products and versions

Product Affected versions Fixed in
YITH WooCommerce Gift Cards 4.12 earliest → 4.12.0 No fix stated
yith_woocommerce_gift_cards 4.12 earliest → 4.12.0 No fix stated
Track this CVE