sbomify Insights

Search by CVE or GitHub advisory id, package name or title.

CVE-2024-7032 Smart Online Order for Clover <= 1.5.6 - Missing Authorization to Plugin Deactivation and Data Deletion

Medium 6.5 Published Updated

Unauthenticated attackers can deactivate the plugin and delete all associated database tables due to missing capability checks.

Exploited in the wild
Not known
Login needed
Not needed
Attackable
Over the internet
Victim action needed
Not needed
Fix
None listed

What is CVE-2024-7032?

CVE-2024-7032 is a medium-severity missing authorization vulnerability in elbanyaoui Smart Online Order for Clover, published on 21 Aug 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

The Smart Online Order for Clover plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the 'moo_deactivateAndClean' function in all versions up to, and including, 1.5.6. This makes it possible for unauthenticated attackers to deactivate the plugin and drop all plugin tables from the database.

Weakness: CWE-862

Which versions are affected by CVE-2024-7032?

It affects 1 product.

Products include Zaytech Smart Online Order for Clover.

How do I fix CVE-2024-7032?

No fix has been published for CVE-2024-7032 yet. Limit exposure of the affected software until one is available.

Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.

Is CVE-2024-7032 being exploited?

There is no known exploitation of CVE-2024-7032 in the wild and no public exploit code.

Sources

Also known as GHSA-qf9m-88xv-jvjp.

Is CVE-2024-7032 in your software?

Upload an SBOM and sbomify checks it against every vulnerability here, every day.

Check your SBOMs for free