CyberRota Analysis
AI-GeneratedThe Reviso Exporter for WooCommerce plugin for WordPress is vulnerable due to inadequate capability checks and nonce verification in the disconnect_callback() function, allowing authenticated attackers with Subscriber-level access or higher to delete the Reviso Agreement Grant Token. This unauthorized modification can disrupt the connection between WooCommerce and the Reviso service, potentially impacting e-commerce operations. WordPress site administrators using this plugin should prioritize applying updates to mitigate this risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
The Reviso Exporter for WooCommerce plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check and missing nonce verification on the disconnect_callback() function in versions up to, and including, 1.2.3. The function is registered to the 'wp_ajax_wcefr-disconnect' AJAX action and unconditionally calls delete_option('wcefr-agt'), which removes the Reviso Agreement Grant Token used to authenticate API calls. This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete the plugin's stored Agreement Grant Token, breaking the connection between WooCommerce and the Reviso service.