CVE-2024-1686: 
WordPress vulnerability analysis and mitigation

The Thank You Page Customizer for WooCommerce – Increase Your Sales plugin for WordPress contains a missing authorization vulnerability (CVE-2024-1686) in all versions up to and including 1.1.2. The vulnerability exists in the apply_layout function due to a missing capability check (NVD).

The vulnerability stems from a missing capability check in the apply_layout function, which allows authenticated users with subscriber-level access or higher to retrieve arbitrary order data that may contain personally identifiable information (PII). The vulnerability has been assigned a CVSS v3.1 base score of 6.5 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N by NIST, while Wordfence assigned a score of 5.3 (Medium) with vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N (NVD).

The vulnerability allows authenticated attackers with subscriber-level access or higher to access arbitrary order data containing personally identifiable information (PII), potentially leading to unauthorized data exposure (NVD).

The vulnerability requires authentication with at least subscriber-level access to exploit. The attack complexity is considered low, requiring no user interaction to execute (NVD).

A patch has been released to address this vulnerability. Users should update to a version newer than 1.1.2 of the Thank You Page Customizer for WooCommerce plugin (WordPress Patch).