CVE-2024-9189 EU/UK VAT Manager for WooCommerce <= 2.12.12 - Missing Authorization
Unauthenticated attackers can modify VAT status for any order due to missing capability checks in the EU/UK VAT Manager for WooCommerce plugin.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2024-9189?
CVE-2024-9189 is a medium-severity missing authorization vulnerability in wpcodefactory EU/UK VAT Validation Manager for WooCommerce, published on 28 Sep 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The EU/UK VAT Manager for WooCommerce plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the alg_wc_eu_vat_exempt_vat_from_admin() function in all versions up to, and including, 2.12.12. This makes it possible for unauthenticated attackers to update the VAT status for any order.
Weakness: CWE-862
Which versions are affected by CVE-2024-9189?
It affects 1 product.
Products include Wpfactory Eu\/Uk Vat Manager for Woocommerce.
How do I fix CVE-2024-9189?
No fix has been published for CVE-2024-9189 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2024-9189 being exploited?
There is no known exploitation of CVE-2024-9189 in the wild and no public exploit code.
Other vulnerabilities in wpcodefactory EU/UK VAT Validation Manager for WooCommerce
Sources
Also known as GHSA-r58j-wf5c-jr5h.