Vulnerability · Published Jan 16, 2024 · Assigned by WPScan
CVE-2023-4703All in One B2B for WooCommerce <= 1.0.3 - Unauthenticated Privilege Escalation
High 7.5
In plain English
A high-severity security flaw in All in One B2B for WooCommerce from Unknown. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.7% (higher than 53% of all known vulnerabilities).
Severity (CVSS 3.1)7.5High
Exploit odds (30 days)0.7%top 47.1% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known
Official description
The All in One B2B for WooCommerce WordPress plugin through 1.0.3 does not properly validate parameters when updating user details, allowing an unauthenticated attacker to update the details of any user. Updating the password of an Admin user leads to privilege escalation.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Unknown | All in One B2B for WooCommerce | 0 – through 1.0.3 |
References
- https://wpscan.com/vulnerability/83278bbb-90e6-4465-a46d-60b4c703c11a/ exploit, vdb-entry, technical-description