GHSA-mh3x-vcwp-x5rhMediumCVSS 4.3
The GSheet For Woo Importer plugin for WordPress is vulnerable to unauthorized loss of data due...
🔗 CVE IDs covered (1)
📋 Description
The GSheet For Woo Importer plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the process_ajax_restore_action() function in all versions up to, and including, 2.3.1. This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete the plugin's Google Sheets API token and configuration options.
🔗 References (4)
- https://nvd.nist.gov/vuln/detail/CVE-2026-4843
- https://plugins.trac.wordpress.org/browser/import-products-from-gsheet-for-woo-importer/tags/2.3.1/src/Actions/AdminSettingsAction.php#L391
- https://www.wordfence.com/threat-intel/vulnerabilities/id/b0d60991-0675-4efa-9427-380e6b59fe28?source=cve
- https://github.com/advisories/GHSA-mh3x-vcwp-x5rh