CVE-2024-0683 is a high severity missing authorization flaw in the Bulgarisation for WooCommerce plugin for WordPress, scored 7.3, in all versions up to and including 3.0.14. Update the plugin to a release later than 3.0.14 and check the Wordfence entry for the exact fixed version.
What's affected
The record says the Bulgarisation for WooCommerce plugin for WordPress is affected in all versions up to and including 3.0.14. I could not retrieve the vendor changeset or advisory pages, so a fixed version is not confirmed here. The record says all versions up to and including 3.0.14 are affected, which implies a later release carries the fix. Check the plugin changelog on WordPress.org and the Wordfence entry before you rely on a specific number.
The vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L: reachable over the network, low complexity, no privileges and no user interaction, with low impact on confidentiality, integrity and availability. The weakness class is CWE-862.
How to check if you're exposed
If you have WP-CLI access, list installed plugins and their versions:
wp plugin list --fields=name,version,status,update
Look for the bulgarisation-for-woocommerce row. If the version is 3.0.14 or lower, you are in the affected range. You can also open Plugins in the WordPress admin and read the version under the plugin name.
To update from the command line:
wp plugin update bulgarisation-for-woocommerce
Deactivated plugins still sit on disk and in some cases can still be reached by URL, so check inactive ones too.
What to do now
- Check the installed version of the plugin on every WordPress site you run, including staging copies.
- Update to the latest release and confirm in the changelog that the issue is addressed.
- If you cannot update right away, deactivate the plugin until you can, or restrict access with your web application firewall.
- Review access logs and the database for unexpected activity if the site was exposed for a long period.
- Add the plugin to the list you watch for new advisories.
Why it matters
Several functions in the plugin do not check whether the caller is allowed to run them. The record says that makes it possible for unauthenticated attackers, and for authenticated users with subscriber level access and above, to generate and delete labels. In a shop that produces shipping or compliance labels, deleting or generating them at will can disrupt orders and fulfilment.
Missing capability checks are among the most common plugin flaws. WordPress exposes many entry points, and each one has to verify who is calling. When a developer registers a function without that check, the function is open to anyone who can reach it. The fix is usually a short permission test, which is why these bugs are cheap to patch and easy to overlook.
The record does not mark this CVE as known exploited, and no advisory I fetched says it is. Plugin flaws like this are still scanned for in bulk once they are public, so patch windows matter more than the exact score.
If the affected component is something your own code pulls in as a dependency, the free in-browser dependency scan at gold.safeguard.sh/scan will tell you whether it appears in your manifests. Reachability analysis then helps you separate the copies that your code actually exercises from the ones that only sit in the tree.
Quick check
What can an attacker do?
According to the record, generate and delete labels. It does not describe access to customer data or code execution.
Does the attacker need an account?
No. The record says unauthenticated attackers can do this, as can subscriber level users.
Sources
Last reviewed: 19 October 2026.
