The Role Based Pricing for WooCommerce WordPress plugin before 1.6.3 does not have authorisation and proper CSRF checks, as well as does not validate path given via user input, allowing any authenticated users like subscriber to perform PHAR deserialization attacks when they can upload a file, and a suitable gadget chain is present on the blog
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Role Based Pricing For Woocommerce Plugin | — | Update role-based-pricing-for-woocommerce plugin to version 1.6.3, or a newer patched version | May 15, 2025 | Oct 17, 2022 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub