{"id":"CVE-2026-4843","aliases":["EUVD-2026-31333","GHSA-mh3x-vcwp-x5rh"],"status":"published","title":"GSheet For Woo Importer \u003c= 2.3.1 - Missing Authorization to Authenticated (Subscriber+) Plugin Settings Reset","description":"The GSheet For Woo Importer plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the process_ajax_restore_action() function in all versions up to, and including, 2.3.1. This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete the plugin's Google Sheets API token and configuration options.","severity":{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.00192,"percentile":0.08975,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-862"],"published":"2026-05-21T19:29:12Z","modified":"2026-07-23T16:10:00Z","products":[{"vendor":"mrdollar4444","product":"gsheet for woo importer"}],"references":[{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b0d60991-0675-4efa-9427-380e6b59fe28?source=cve"},{"url":"https://plugins.trac.wordpress.org/browser/import-products-from-gsheet-for-woo-importer/tags/2.3.1/src/Actions/AdminSettingsAction.php#L391"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-4843"},{"url":"https://github.com/advisories/GHSA-mh3x-vcwp-x5rh"}],"sources":{"cve":[{"id":"CVE-2026-4843","title":"GSheet For Woo Importer \u003c= 2.3.1 - Missing Authorization to Authenticated (Subscriber+) Plugin Settings Reset","description":"The GSheet For Woo Importer plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the process_ajax_restore_action() function in all versions up to, and including, 2.3.1. This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete the plugin's Google Sheets API token and configuration options.","status":"published","published":"2026-05-21T19:29:12.127Z","modified":"2026-05-22T13:55:49.485Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-862"],"updated_at":"2026-11-02T14:19:58.944663Z"}],"euvd":[{"id":"EUVD-2026-31333","description":"The GSheet For Woo Importer plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the process_ajax_restore_action() function in all versions up to, and including, 2.3.1. This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete the plugin's Google Sheets API token and configuration options.","status":"published","published":"2026-05-21T19:29:12Z","modified":"2026-05-22T13:55:49Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T18:21:12.491464Z"}],"ghsa":[{"id":"GHSA-mh3x-vcwp-x5rh","title":"The GSheet For Woo Importer plugin for WordPress is vulnerable to unauthorized loss of data due...","description":"The GSheet For Woo Importer plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the process_ajax_restore_action() function in all versions up to, and including, 2.3.1. This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete the plugin's Google Sheets API token and configuration options.","status":"published","published":"2026-05-21T21:30:36Z","modified":"2026-05-21T21:30:37Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"cwes":["CWE-862"],"updated_at":"2026-11-02T15:08:15.652571Z"}],"nvd":[{"id":"CVE-2026-4843","description":"The GSheet For Woo Importer plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the process_ajax_restore_action() function in all versions up to, and including, 2.3.1. This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete the plugin's Google Sheets API token and configuration options.","status":"published","published":"2026-05-21T20:16:14.723Z","modified":"2026-07-23T16:10:00.137Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-862"],"updated_at":"2026-11-02T14:12:19.752984Z"}]}}