CyberRota Analysis
AI-GeneratedThe WC Vendors WordPress plugin prior to version 2.7.2.1 is vulnerable due to improper verification of user-supplied IDs, enabling authenticated users with vendor roles to manipulate product variations and alter the status and title of posts belonging to other vendors. This could lead to unauthorized changes and potential data integrity issues within the platform. WordPress site administrators using this plugin should prioritize updating to the latest version to mitigate these risks.
Original NVD Description
The WC Vendors WordPress plugin before 2.7.2.1 does not verify ownership or the object type of user-supplied IDs when saving product variations, allowing authenticated users with the vendor role to modify product variations belonging to other vendors, and to change the status and title of arbitrary posts, via IDOR.