vulnerability

WordPress Plugin: woocommerce-product-sort-and-display: CVE-2024-1807: Missing Authorization

Try Surface Command

Back to search

Severity

CVSS

(AV:N/AC:L/Au:N/C:N/I:P/A:P)

Published

Apr 1, 2024

Added

May 15, 2025

Modified

Apr 30, 2026

Description

The Product Sort and Display for WooCommerce plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the psad_update_product_cat_custom_meta_ajax function in all versions up to, and including, 2.4.1. This makes it possible for unauthenticated attackers to hide product categories.

Solution

woocommerce-product-sort-and-display-plugin-cve-2024-1807

References

https://www.cve.org/CVERecord?id=CVE-2024-1807
https://www.wordfence.com/threat-intel/vulnerabilities/id/c8bd778b-1d56-4544-b2c3-a77a7ec05aa4?source=api-prod
https://euvd.enisa.europa.eu/vulnerability/EUVD-2024-17532
CVE-2024-1807
https://attackerkb.com/topics/CVE-2024-1807
CWE-862
EUVD-EUVD-2024-17532

Rapid7 Labs

2026 Global Threat Landscape Report

The predictive window has collapsed. Exploitation follows disclosure in days. See how attackers are accelerating and how to stay ahead.

Get report