WC Plus WordPress Plugin Missing Capability Check Vulnerability in Favicon Logo Base Update
Vulnerability
A vulnerability exists in the WC Plus plugin for WordPress, all versions through 1.2.0, allowing unauthorized data modification. The issue arises from a lack of proper capability checks on the 'pluswc_logo_favicon_logo_base' AJAX action, enabling unauthenticated attackers to change the site's favicon logo base.
Impact
Exploitation of this vulnerability allows for unauthorized modification of the site's favicon logo base.
Added: Aug 23, 2025, 5:22 AM
Updated: Aug 23, 2025, 5:22 AM
Vulnerability Rating
Custom Algorithm
spread
0.0impact
0.6exploitability
7.4remediation
0.0relevance
0.4threat
0.0urgency
2.9incentive
5.8Our algorithm analyzes dozens of metrics to generate these 8 key vulnerability categories, which are then combined to calculate the overall risk score.