CVE-2024-0201

The Product Expiry for WooCommerce plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'save_settings' function in versions up to, and including, 2.5. This makes it possible for authenticated attackers, with subscriber-level permissions or above to update plugin settings. CVE-2023-52179 appears to be a duplicate of this issue.

• CWE-862
• CWE-862

• https://plugins.trac.wordpress.org/browser/product-expiry-for-woocommerce/tags/2.5/product-expiry-for-woocommerce.php#L263Issue Tracking
• https://plugins.trac.wordpress.org/browser/product-expiry-for-woocommerce/tags/2.6/product-expiry-for-woocommerce.php?rev=3014924#L263Issue Tracking
• https://www.wordfence.com/threat-intel/vulnerabilities/id/c4006612-770a-482f-a8c2-e62f607914a9?source=cveThird Party Advisory
• https://plugins.trac.wordpress.org/browser/product-expiry-for-woocommerce/tags/2.5/product-expiry-for-woocommerce.php#L263Issue Tracking
• https://plugins.trac.wordpress.org/browser/product-expiry-for-woocommerce/tags/2.6/product-expiry-for-woocommerce.php?rev=3014924#L263Issue Tracking
• https://www.wordfence.com/threat-intel/vulnerabilities/id/c4006612-770a-482f-a8c2-e62f607914a9?source=cveThird Party Advisory

Published

Jan 3, 2024

Last Modified

Jun 17, 2026

Status

Modified

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-0195A vulnerability, which was classified as critical, was found…9.8
• CVE-2024-0196A vulnerability has been found in Magic-Api up to 2.0.1 and …8.8
• CVE-2024-0197A flaw in the installer for Thales SafeNet Sentinel HASP LDK…7.8
• CVE-2024-0198Rejected reason: This CVE ID has been rejected or withdrawn …
• CVE-2024-0199An authorization bypass vulnerability was discovered in GitL…8
• CVE-2024-0200An unsafe reflection vulnerability was identified in GitHub …9.8
• CVE-2024-0202A security vulnerability has been identified in the cryptlib…5.9
• CVE-2024-0203The Digits plugin for WordPress is vulnerable to Cross-Site …8.8
• CVE-2024-0204Authentication bypass in Fortra's GoAnywhere MFT prior to 7.…9.8
• CVE-2024-0206 A symbolic link manipulation vulnerability in Trellix Anti-…7.8
• CVE-2024-0207HTTP3 dissector crash in Wireshark 4.2.0 allows denial of se…7.5
• CVE-2024-0208GVCP dissector crash in Wireshark 4.2.0, 4.0.0 to 4.0.11, an…7.5