CVE-2024-10854: 
WordPress vulnerability analysis and mitigation

The Buy one click WooCommerce plugin for WordPress contains a vulnerability (CVE-2024-10854) related to unauthorized modification of data. The vulnerability affects all versions up to and including 2.2.9, discovered and disclosed on November 12, 2024. The issue stems from a missing capability check on the buyoneclickimportoptions AJAX action, which affects WordPress installations using this plugin (NVD).

The vulnerability is classified as a Broken Access Control issue (CWE-862) due to a missing capability check. It has been assigned a CVSS v3.1 base score of 4.3 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N. This indicates that the vulnerability requires network access and low privileges to exploit, with no user interaction needed (Wordfence).

The vulnerability allows authenticated attackers with Subscriber-level access or higher to import plugin settings. While the severity is considered low, it could potentially lead to unauthorized modification of plugin configurations (NVD, Patchstack).

As of November 11, 2024, the plugin has been closed and is no longer available for download from the WordPress plugin repository due to this security issue. No official fix is currently available (WordPress Plugin).