CVE-2020-36834: The Discount Rules for WooCommerce plugin for WordPress is vulnerable to missing authorization via several AJAX actions in versions up to, and including, 2.0.2…

PriorityP278medium6.3CVSS 3.1

AVNACLPRLUINSUCLILAL

ITWVulnCheck KEV

Exploited in the wild

EPSS

0.34%

25.7th percentile

The Discount Rules for WooCommerce plugin for WordPress is vulnerable to missing authorization via several AJAX actions in versions up to, and including, 2.0.2 due to missing capability checks on various functions. This makes it possible for subscriber-level attackers to execute various actions and perform a wide variety of actions such as modifying rules and saving configurations.

Affected

1 ranges

Vendor	Product	Version range	Fixed in
flycart	discount_rules_for_woocommerce	<= 2.0.2	—

CVSS provenance

nvdv3.16.3MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

vulncheck6.3MEDIUM

CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.