CVE-2024-13424 describes a missing authorization vulnerability in the Ni Sales Commission For WooCommerce plugin for WordPress, affecting all versions up to and including 1.2.4. The vulnerability arises because the 'niwoosc_ajax' AJAX endpoint does not perform a capability check, allowing authenticated users with Subscriber-level privileges or higher to modify plugin settings and commission amounts. This flaw is categorized under CWE-862. The CVSS 3.1 score is 4.3 (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N), reflecting a network attack vector with low complexity, requiring low privileges, no user interaction, unchanged scope, no confidentiality or availability impact, but low integrity impact.

An attacker with at least Subscriber-level access can modify plugin settings and commission amounts, potentially leading to unauthorized changes in sales commission configurations. There is no impact on confidentiality or availability reported. The integrity of commission data can be altered, which may affect financial calculations or payouts within the WooCommerce environment.

Patch status is not yet confirmed — no official fix or patch links are provided. Users should monitor the vendor's advisory channels for updates. Until a patch is available, restrict user roles carefully to limit Subscriber-level access and above to trusted users only. Consider disabling or restricting access to the vulnerable AJAX endpoint if possible through custom code or security plugins.