CVE-2024-1639: saadiqbal license manager for woocommerce Incorrect Authorization

Vulnerability summary

CVE-2024-1639 is a medium (CVSS 6.5) Incorrect Authorization vulnerability in saadiqbal license manager for woocommerce. EPSS estimates a 0.39% chance of exploitation in the next 30 days, higher than 32.3% of scored vulnerabilities. Fixed in 3.0.7.

Timeline

1. 21-06-2024
   PublishedVulnerability first disclosed.
2. 08-04-2026
   Last modifiedVulnerability information updated.

Description

The License Manager for WooCommerce plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the showLicenseKey() and showAllLicenseKeys() functions in all versions up to, and including, 3.0.6. This makes it possible for authenticated attackers, with admin dashboard access (contributors by default due to WooCommerce) to view arbitrary decrypted license keys. The functions contain a referrer nonce check. However, these can be retrieved via the dashboard through the "license" JS variable. Please note that the version in trunk is patched, however, the 3.0.7 tagged version is not.

• CWE-863Incorrect AuthorizationThe product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.
• CWE-862Missing AuthorizationThe product does not perform an authorization check when an actor attempts to access a resource or perform an action.