Hide Category by User Role for WooCommerce Missing Authorization Vulnerability Allowing Unauthenticated Cache Flushing

A missing authorization vulnerability has been identified in the Hide Category by User Role for WooCommerce plugin for WordPress, affecting all versions through 2.3.1. The vulnerability arises from a lack of capability checks on the admin_init hook, which triggers the wp_cache_flush() function. This oversight enables unauthenticated attackers to send forged requests that flush the site's object cache, potentially leading to degraded site performance.

Impact

Exploitation of this vulnerability allows for unauthorized flushing of the site's object cache, which can degrade site performance.

Remediation

Users can update to version 2.3.2 or a newer patched version to address this vulnerability.