CyberRota Analysis
AI-GeneratedThe advanced-customized-prompts WordPress plugin versions up to 1.0.1 are vulnerable due to inadequate checks on capability, ownership, and nonce validation when updating WooCommerce order item metadata. This flaw allows any authenticated user, including those with low-level permissions like subscribers, to manipulate custom metadata for orders belonging to other customers, potentially leading to data integrity issues. WordPress site administrators and developers using this plugin should prioritize patching or mitigating this vulnerability to protect customer data.
Original NVD Description
The advanced-customized-prompts WordPress plugin through 1.0.1 does not perform any capability, ownership, or nonce check before updating WooCommerce order item metadata for a supplied order, allowing any authenticated user such as a subscriber to tamper with the custom metadata of orders belonging to other customers.