WordPress Plugin Vulnerabilities

WPC Product Bundles for WooCommerce < 7.3.2 - Cross-Site Request Forgery

Description

The WPC Product Bundles for WooCommerce plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 7.3.1. This is due to missing or incorrect nonce validation on several functions in /includes/class-woosb.php. This makes it possible for unauthenticated attackers to update search settings via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.

Affects Plugins

Plugin icon
woo-product-bundle
Fixed in 7.3.2

References

CVE
CVE-2023-52127
URL
https://www.wordfence.com/threat-intel/vulnerabilities/id/5188dc72-a00d-4a07-b178-3f3ef26d7fc1

Classification

Type
CSRF
OWASP top 10
A2: Broken Authentication and Session Management
CWE
CWE-352
CVSS
4.3 (medium)

Miscellaneous

Original Researcher
Brandon James Roldan (tomorrowisnew)
Verified
No
WPVDB ID
201ccbc2-db06-403c-8548-b4adf8135af0

Timeline

Publicly Published
2023-12-28 (about 2 years ago)
Added
2024-01-05 (about 2 years ago)
Last Updated
2024-01-22 (about 2 years ago)

Other

Published
Title
Published
2021-03-01
Title
Better Search < 2.5.3 - Cross-Site Request Forgery
Published
2025-12-08
Title
Advanced Product Fields (Product Addons) for WooCommerce < 1.6.18 - Cross-Site Request Forgery to Product Field Group Duplication and Publication
Published
2025-12-11
Title
Purchase and Expense Manager <= 1.1.2 - Cross-Site Request Forgery to Arbitrary Purchase Record Deletion
Published
2024-07-11
Title
Ntz Antispam <= 2.0e - Settings Update via CSRF
Published
2014-08-01
Title
facebook-members 5.0.4 - Setting Manipulation CSRF