¿Es seguro Woo Discount Rules?

Qué hace este plugin

• Slug: woo-discount-rules
• 100000+ instalaciones activas

bulk discountcouponsdiscountsdynamic pricingwoocommerce

Estado de mantenimiento

• Última versión conocida: 2.6.16
• PHP máximo soportado (analizado): 8.4

Vulnerabilidades conocidas

3 CVEs conocidos registrados para Woo Discount Rules. Reportadas entre 2020 y 2024.

CVE-2020-36834

The Discount Rules for WooCommerce plugin for WordPress is vulnerable to missing authorization via several AJAX actions in versions up to, and including, 2.0.2 due to missing capability checks on various functions. This makes it possible for subscriber-level attackers to execute various actions and perform a wide variety of actions such as modifying rules and saving configurations.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: CVE.org

CVE-2024-8541

The Discount Rules for WooCommerce – Create Smart WooCommerce Coupons & Discounts, Bulk Discount, BOGO Coupons plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escaping on the URL in all versions up to, and including, 2.6.5. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a site administrator into performing an action such as clicking on a link. Please note that this is only exploitable when the 'Leave a Review' notice is present, which occurs after 100 orders are made and disappears after a user dismisses the notice.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: CVE.org

CVE-2022-2090

Reflected Cross-Site Scripting (XSS) vulnerability discovered by ZhongFu Su aka JrXnm (WuHan University) in WordPress Discount Rules for WooCommerce plugin (versions <= 2.4.1). Update the WordPress Discount Rules for WooCommerce plugin to the latest available version (at least 2.4.2).

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: Patchstack

Discount Rules for WooCommerce [woo-discount-rules] < 2.2.1

Multiple Authorization Bypass vulnerabilities found by WordFence in WordPress Discount Rules for WooCommerce plugin (versions <= 2.2.0).

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: Patchstack

Discount Rules for WooCommerce [woo-discount-rules] < 2.2.1

The Discount Rules for WooCommerce plugin for WordPress is vulnerable to missing authorization via several AJAX actions in versions up to, and including, 2.2.0 due to missing capability checks on various functions. This makes it possible for subscriber-level attackers to execute various actions and perform a wide variety of actions such as modifying discount rules.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: Wordfence

Discount Rules for WooCommerce [woo-discount-rules] < 2.1.0

Multiple (XSS, SQLi) Vulnerabilities found by WebARX Security in WordPress Discount Rules for WooCommerce plugin (versions <= 2.0.2).

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: Patchstack

Discount Rules for WooCommerce [woo-discount-rules] < 2.1.0

The Discount Rules for WooCommerce plugin for WordPress is vulnerable to missing authorization via several AJAX actions in versions up to, and including, 2.0.2 due to missing capability checks on various functions. This makes it possible for subscriber-level attackers to execute various actions and perform a wide variety of actions such as modifying rules and saving configurations.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: Wordfence

Discount Rules for WooCommerce [woo-discount-rules] < 2.1.0

The Discount Rules for WooCommerce plugin (versions below 2.1.0) suffers from multiple vulnerabilities such as SQL injection, authorization issues and unauthenticated stored cross-site scripting. The issues in this plugin are caused due to a lack of authorization and nonce token check. The plugin registers several AJAX actions of which one, wp_ajax_wdr_ajax, handles a bulk of different AJAX actions which are supposedly only be accessed by administrators. Unfortunately this AJAX action is also registered as wp_ajax_nopriv_wdr_ajax. Even if wp_ajax_nopriv_wdr_ajax was not registered, authenticated users could still exploit this since wp_ajax_wdr_ajax does not perform any type of authorization or CSRF check. Particularly the wdr_ajax_save_configuration method that can be executed in this AJAX action can cause significant damage to the site as it allows you to write any type of HTML or JavaScript to any template hook of the site, including wp-admin.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: WPScan

+ 1 vulnerabilidad conocida más

CVE	Vulnerabilidad	Tipo	Gravedad	Afectadas	Corregido en	Publicado	Estado
—	Discount Rules for WooCommerce [woo-discount-rules] < 2.2.1	—	Desconocido	< 2.2.1	2.2.1	—	✓ corregido en la última versión

Discount Rules for WooCommerce [woo-discount-rules] < 2.2.1

On August 20th 2020 WebARX disclosed multiple vulnerabilities affecting the Discount Rules for WooCommerce WordPress plugin, which were patched in version 2.1.0 (see references). Some time after, the Wordfence Threat Intelligence Team discovered several additional authorization bypass vulnerabilities affecting the Discount Rules for WooCommerce WordPress plugin. The bypasses could lead to Stored Cross-Site Scripting (XSS).

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: WPScan

Cómo solucionarlo

Mantén Woo Discount Rules actualizado — 2.6.16 es la última versión en wordpress.org, y cada CVE de arriba indica la versión exacta que lo corrigió ("Corregido en").

Este es el historial completo de vulnerabilidades conocidas del plugin, no un escaneo de una instalación específica — ejecuta un escaneo gratis de tu propio sitio para verificar tu versión instalada exacta.

Alternativas más seguras / más establecidas

• Advanced Dynamic Pricing and Discount Rules for WooCommerce — 20000+ instalaciones activas — 94/100 (119) — PHP máx. 8.4
• Discount Rules and Dynamic Pricing for WooCommerce — 10000+ instalaciones activas — 94/100 (247) — PHP máx. 8.4
• Extended Coupon Features for WooCommerce FREE — 10000+ instalaciones activas — 100/100 (69) — PHP máx. <8.0
• Coupon Generator for WooCommerce — 10000+ instalaciones activas — 90/100 (35)
• Simple Discount Rules for Woocommerce — 4000+ instalaciones activas — 92/100 (72)