CVE-2024-0201

MediumCVSS 4.3/10Last modified Jun 17, 2026

Description

The Product Expiry for WooCommerce plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'save_settings' function in versions up to, and including, 2.5. This makes it possible for authenticated attackers, with subscriber-level permissions or above to update plugin settings. CVE-2023-52179 appears to be a duplicate of this issue.

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Weakness enumeration

CWE-862

Affected software

Vendor	Product	Versions
webcodingplace	Product Expiry for WooCommerce	<= 2.5

References

Timeline

Published: Jan 3, 2024
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2024

CVE-2024-02025.9A security vulnerability has been identified in the cryptlib cryptographic library when cryptlib is compiled with the support for RSA key ex CVE-2024-02038.8The Digits plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 8.4.1. This is due to missing CVE-2024-02049.8Authentication bypass in Fortra's GoAnywhere MFT prior to 7.4.1 allows an unauthorized user to create an admin user via the administration p CVE-2024-02067.8A symbolic link manipulation vulnerability in Trellix Anti-Malware Engine prior to the January 2024 release allows an authenticated local us CVE-2024-02077.5HTTP3 dissector crash in Wireshark 4.2.0 allows denial of service via packet injection or crafted capture file CVE-2024-02087.5GVCP dissector crash in Wireshark 4.2.0, 4.0.0 to 4.0.11, and 3.6.0 to 3.6.19 allows denial of service via packet injection or crafted captu CVE-2024-02097.5IEEE 1609.2 dissector crash in Wireshark 4.2.0, 4.0.0 to 4.0.11, and 3.6.0 to 3.6.19 allows denial of service via packet injection or crafte CVE-2024-02107.5Zigbee TLV dissector crash in Wireshark 4.2.0 allows denial of service via packet injection or crafted capture file CVE-2024-02117.5DOCSIS dissector crash in Wireshark 4.2.0 allows denial of service via packet injection or crafted capture file CVE-2024-02126.5The Cloudflare Wordpress plugin was found to be vulnerable to improper authentication. The vulnerability enables attackers with a lower priv CVE-2024-02137.8A buffer overflow vulnerability in TA for Linux and TA for MacOS prior to 5.8.1 allows a local user to gain elevated permissions, or cause a CVE-2024-02166.4The Google Doc Embedder plugin for WordPress is vulnerable to Server Side Request Forgery via the 'gview' shortcode in versions up to, and i