Description

Missing Authorization vulnerability in Codection Products Restricted Users for WooCommerce woo-products-restricted-users allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Products Restricted Users for WooCommerce: from n/a through 0.7.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.3",
  "pubDate": "2026-10-12T09:16:42.050Z",
  "pubdate": "2026-10-12T09:16:42.050Z",
  "executiveSummary": "The Products Restricted Users for WooCommerce plugin, specifically in versions n/a through 0.7, contains a Missing Authorization vulnerability. This security flaw stems from an incorrectly configured access control mechanism that fails to properly validate user permissions before granting access to restricted functionality.\nThis vulnerability exposes the system to unauthorized access, potentially allowing remote attackers to interact with restricted resources or settings intended only for administrative or privileged users. Because the plugin manages product visibility and access controls within the WooCommerce ecosystem, the impact of this vulnerability is significant, as it undermines the integrity of access restrictions placed on products.\nSuccessful exploitation does not require advanced technical capabilities but relies on the misconfiguration of the plugin's security levels. Attackers can bypass intended restrictions, leading to unauthorized data disclosure or improper modification of site content. Organizations utilizing this plugin should immediately assess their exposure and implement the necessary restrictions to mitigate the risk of unauthorized access.",
  "technicalDetails": "The root cause of this vulnerability is an insecure implementation of access control checks within the Products Restricted Users for WooCommerce plugin. The plugin fails to perform rigorous server-side authorization checks for specific actions or requests, effectively allowing unauthorized users to perform operations that should be restricted based on their role or permission level.\nIn the context of the WordPress and WooCommerce ecosystem, plugins often use hooks and action handlers to verify if the current user possesses sufficient capabilities (such as 'manage_woocommerce' or 'edit_posts') before executing sensitive code paths. In this specific instance, the plugin's codebase lacks these mandatory checks or incorrectly validates the session tokens, allowing attackers to access functions that manipulate product visibility and restriction settings.\nThe attack flow generally follows a predictable pattern: 1) An attacker identifies the request parameters or the specific endpoint associated with the restricted access feature. 2) The attacker crafts a request, such as an HTTP POST or GET request, targeting these endpoints. 3) Because the server-side code fails to verify the current user's authorization or capability, the system processes the request as if it were legitimate. 4) The plugin executes the requested operation, such as toggling visibility settings for restricted products or modifying access rules, bypassing the intended security architecture.\nThe vulnerability affects versions from n/a through 0.7. The scope of exploitation is not limited to specific network segments, as these requests are typically routed through the standard web server handling WooCommerce traffic. Consequently, any remote, unauthenticated, or low-privileged user capable of interacting with the plugin's frontend or backend AJAX hooks can trigger the vulnerability.\nThe post-exploitation impact includes the circumvention of product access restrictions, which may lead to unauthorized exposure of proprietary or private catalog items. Furthermore, if the authorization check is missing on administrative settings, an attacker may be able to alter plugin configuration, potentially leading to further privilege escalation or unauthorized modification of the WooCommerce store environment. The lack of proper nonce verification, if present in the affected area, may also increase the likelihood of cross-site request forgery (CSRF) vectors being combined with this missing authorization flaw."
}