Medium severity · published Sep 28, 2024
CVE-2024-9189
EU/UK VAT Manager for WooCommerce <= 2.12.12 - Missing Authorization
5.3
CVSS
0.5%
EPSS
No
On KEV
Description
The EU/UK VAT Manager for WooCommerce plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the alg_wc_eu_vat_exempt_vat_from_admin() function in all versions up to, and including, 2.12.12. This makes it possible for unauthenticated attackers to update the VAT status for any order.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
Low
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.5% · higher than 41% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
EV
EU/UK VAT Validation Manager for WooCommerce · wpcodefactory
through 2.12.12 · source: vendor
EV
Eu/uk Vat Manager For Woocommerce · Wpfactory
before 2.12.14 · source: NVD
EV
Eu\/uk Vat Manager · Wpfactory
through 2.12.12 · source: CISA
Affected product
EV
EU/UK VAT Validation Manager for WooCommerce
wpcodefactory
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-9189
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-9189
Product
https://plugins.trac.wordpress.org/browser/eu-vat-for-woocommerce/tags/2.12.12/includes/class-alg-wc-eu-vat-ajax.php#L285
Patch
https://plugins.trac.wordpress.org/changeset/3158296/
Third Party Advisory
https://www.wordfence.com/threat-intel/vulnerabilities/id/c6db680e-1fd4-420c-98f4-2b6dc5cf6781?source=cve
More from EU/UK VAT Validation Manager for WooCommerce
6.1
CVE-2024-8788
EU/UK VAT Manager for WooCommerce <= 2.12.12 - Reflected Cross-Site Scripting