Ni Sales Commission For WooCommerce Missing Authorization Vulnerability on AJAX Endpoint

A vulnerability exists in the Ni Sales Commission For WooCommerce plugin for WordPress, in all versions through 1.2.4. The issue arises from a missing capability check on the 'niwoosc_ajax' AJAX endpoint, allowing authenticated attackers with Subscriber-level access and above to unauthorizedly access and modify the plugin's settings and commission amounts.

Impact

Exploitation of this vulnerability allows for unauthorized modification of commission amounts and plugin settings by authenticated users with Subscriber-level access or higher.