CVE-2023-6638

MEDIUM

GTG Product Feed for Shopping <1.2.4 - Info Disclosure

Title source: llm

Description

The GTG Product Feed for Shopping plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'update_settings' function in versions up to, and including, 1.2.4. This makes it possible for unauthenticated attackers to update plugin settings.

References (3)

Core 3

Core References

https://plugins.trac.wordpress.org/changeset/3026053

Product

https://plugins.trac.wordpress.org/browser/gg-woo-feed/trunk/inc/Admin/Admin.php?rev=2933599#L199

Third Party Advisory

https://www.wordfence.com/threat-intel/vulnerabilities/id/ce6b9b0a-e82e-459a-bddf-1c9354bcec00?source=cve

Scores

CVSS v3 6.5

EPSS 0.0054

EPSS Percentile 41.5%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L

CISA SSVC

Vulnrichment

Exploitation none

Automatable yes

Technical Impact partial

Details

CWE

CWE-862

Status published

Products (2)

gutengeek/gg_woo_feed < 1.2.4

wpopal/GG Woo Feed for WooCommerce Shopping Feed on Google and Other Channels < 1.2.4

Published Jan 11, 2024

Tracked Since Feb 18, 2026