CVE-2024-10854: 
WordPress vulnerability analysis and mitigation

The Buy one click WooCommerce plugin for WordPress contains a vulnerability (CVE-2024-10854) related to unauthorized modification of data. The vulnerability affects all versions up to and including 2.2.9, discovered and disclosed on November 12, 2024. The issue stems from a missing capability check on the buy_one_click_import_options AJAX action, which affects WordPress installations using this plugin (NVD).

The vulnerability is classified as a Broken Access Control issue (CWE-862) due to a missing capability check. It has been assigned a CVSS v3.1 base score of 4.3 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N. This indicates that the vulnerability requires network access and low privileges to exploit, with no user interaction needed (Wordfence).

The vulnerability allows authenticated attackers with Subscriber-level access or higher to import plugin settings. While the severity is considered low, it could potentially lead to unauthorized modification of plugin configurations (NVD, Patchstack).

The vulnerability has a low severity impact and is considered unlikely to be exploited. It requires an authenticated user with at least Subscriber-level access to perform the attack (Patchstack).

As of November 11, 2024, the plugin has been closed and is no longer available for download from the WordPress plugin repository due to this security issue. No official fix is currently available (WordPress Plugin).