CVE-2024-10852 describes a missing authorization vulnerability in the Buy one click WooCommerce plugin for WordPress (versions up to 2.2.9). The issue arises from the lack of a capability check on the buy_one_click_export_options AJAX action, enabling any authenticated user with at least Subscriber privileges to export plugin settings. This vulnerability is categorized under CWE-862 (Missing Authorization). The CVSS 3.1 score of 4.3 reflects a network attack vector with low complexity, requiring low privileges and no user interaction, impacting confidentiality only.

An attacker with Subscriber-level access or higher can export plugin configuration settings without proper authorization. This could lead to unauthorized disclosure of potentially sensitive plugin configuration data. There is no indication of impact on integrity or availability. No known exploits are reported in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict user roles to trusted individuals only and monitor for suspicious activity related to the buy_one_click_export_options AJAX action. Avoid granting Subscriber or higher privileges to untrusted users. Apply updates promptly once a vendor patch is available.