Docket (WooCommerce Collections / Wishlist / Watchlist) < 1.7.0 is vulnerable to Unauthenticated Arbitrary Post/Page Deletion vulnerability

Unauthenticated

Published
2024-08-06

The Docket (WooCommerce Collections / Wishlist / Watchlist) plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in all versions up to 1.7.0 (exclusive). This makes it possible for unauthenticated attackers to delete arbitrary pages and posts.

CVE

https://www.cve.org/CVERecord?id=CVE-2024-43131

CVSS

Score:7.5

Severity:High

Version:< 1.7.0

There is a patch available in v1.7.0 and we strongly recommend you update to this version as soon as possible.