CVE-2024-1639 describes a missing authorization vulnerability in the License Manager for WooCommerce plugin for WordPress, affecting all versions up to and including 3.0.6. The functions showLicenseKey() and showAllLicenseKeys() lack proper capability checks, enabling authenticated users with admin dashboard access (such as contributors) to retrieve arbitrary decrypted license keys. Although a referrer nonce check exists, it can be bypassed because the nonce is accessible via the dashboard's JavaScript variables. The vulnerability is fixed in the development trunk but remains unpatched in the latest tagged version 3.0.7. This vulnerability is categorized under CWE-862 and has a CVSS 3.1 base score of 6.5 (medium severity).

An authenticated user with at least contributor-level access to the WordPress admin dashboard can access decrypted license keys without proper authorization. This exposure could lead to unauthorized disclosure of sensitive license data. There is no indication of impact on integrity or availability. No known exploits are reported in the wild at this time.

Currently, there is no official patch released for the tagged version 3.0.7. The vulnerability is fixed in the development trunk, so users should monitor the vendor's official channels for an upcoming patch release. Until an official fix is available, restrict admin dashboard access to trusted users only and consider removing or disabling the License Manager for WooCommerce plugin if license key confidentiality is critical. Patch status is not yet confirmed for released versions — check the vendor advisory for current remediation guidance.