GoHero Store Customizer for WooCommerce Missing Authorization Vulnerability in WordPress

A vulnerability exists in the GoHero Store Customizer for WooCommerce plugin for WordPress, all versions through 3.5. The issue arises from a missing capability check in the wooh_action_settings_save_frontend() function, allowing unauthorized users to modify certain plugin settings. This vulnerability could be exploited by unauthenticated attackers to make unauthorized changes to plugin data.

Impact

Exploitation of this vulnerability allows for unauthorized modification of plugin settings, which could lead to unintended changes in the WooCommerce store customization.

Remediation

Users are advised to update the GoHero Store Customizer for WooCommerce plugin to version 4.0 or later, where this vulnerability has been patched.