The MIMO Woocommerce Order Tracking plugin for WordPress suffers from a missing capability check in the 'mimo_update_provider' function in all versions up to 1.0.2. This flaw permits authenticated attackers with low-level privileges (Subscriber and above) to update shipping provider information without proper authorization. The unauthorized update capability can be exploited to insert stored cross-site scripting (XSS) payloads, potentially impacting the confidentiality and integrity of the affected system. The vulnerability is tracked as CVE-2024-5768 and is classified under CWE-862 (Missing Authorization). The CVSS v3.1 base score is 6.4, reflecting network attack vector, low attack complexity, low privileges required, no user interaction, and partial impact on confidentiality and integrity.

An attacker with Subscriber-level access or higher can exploit this vulnerability to modify shipping provider information in the plugin, including injecting stored cross-site scripting payloads. This can lead to unauthorized data modification and potential client-side script execution, impacting confidentiality and integrity of data handled by the plugin. There is no indication of availability impact. No known exploits in the wild have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict user roles to trusted individuals only and monitor for suspicious activity related to shipping provider data updates. Avoid granting Subscriber-level or higher access to untrusted users. Follow vendor communications for updates on patches or official fixes.