CWE Code: 94
Vulnerability Type: privilege_escalation
CVSS Score: 6.5
CWE Name:  Improper Control of Generation of Code ('Code Injection')
Summary: in the automattic woocommerce plugin before 3.2.4 for wordpress, an attack is possible after gaining access to the target site with a user account that has at least shop manager privileges. the attacker then constructs a specifically crafted string that will turn into a php object injection involving the includes/shortcodes/class-wc-shortcode-products.php wc_shortcode_products::get_products() use of cached queries within shortcodes.
Access Authentication: SINGLE
Access Complexity: LOW
Access Vector: NETWORK
Impact (C/I/A): PARTIAL/PARTIAL/PARTIAL
Published Date: 2019-01-15
Last Modified Date: 2019-02-07