TI-2025-07145 CVE-2025-7821 · GHSA-qc92-85mg-gr37
WC Plus <= 1.2.0 - Missing Authorization to Unauthenticated Settings Manipulation
Priority LOW 30
The WC Plus plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'pluswc_logo_favicon_logo_base' AJAX action in all versions up to, and including, 1.2.0.