What is CVE-2024-0797?

CVE-2024-0797 is a medium-severity vulnerability in Pluginus Woot, classified under Missing Authorization. CVSS score: 4.3/10. Published 2024-02-05.

How severe is CVE-2024-0797?

Medium severity. CVSS v3 base score is 4.3 out of 10.

Is CVE-2024-0797 known to be exploited?

1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.

Auth bypass in Pluginus Woot

CVE-2024-0797

The Active Products Tables for WooCommerce. Professional products tables for WooCommerce store plugin for WordPress is vulnerable to unauthorized access of functionality due to a missing capability check on several functions in all versions up to, and including, 1.0.6.1. This makes it possible for subscribers and higher to execute functions intended for admin use.

Vulnerability class: Broken Access Control

EPSS: 0.004 (34.8th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 4.3 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N.

Affected products

Pluginus Woot
Realmag777 Active Products Tables For Woocommerce. Use Constructor To Create — versions 0

Weakness classification (CWE)

CWE-862 — Missing Authorization

Public proof-of-concept exploits

20142995/nuclei-templates

References

security@wordfence.com (Third Party Advisory)
security@wordfence.com (Patch)

Frequently asked questions

What is CVE-2024-0797?: CVE-2024-0797 is a medium-severity vulnerability in Pluginus Woot, classified under Missing Authorization. CVSS score: 4.3/10. Published 2024-02-05.
How severe is CVE-2024-0797?: Medium severity. CVSS v3 base score is 4.3 out of 10.
Is CVE-2024-0797 known to be exploited?: 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.