ECPay Ecommerce for WooCommerce Missing Authorization Vulnerability Allowing Log Deletion

A vulnerability exists in the ECPay Ecommerce for WooCommerce plugin for WordPress, in all versions through 1.1.2411060. The issue arises from a lack of proper capability checks on the 'clear_ecpay_debug_log' AJAX action. This flaw enables authenticated attackers with Subscriber-level access or higher to delete the plugin's log files, leading to unauthorized data loss.

Impact

Exploitation of this vulnerability allows for unauthorized deletion of the plugin's log files by authenticated users with Subscriber-level access or higher.

Remediation

Users can update to version 1.1.2502030 or a newer patched version to address this vulnerability.