WordPress Plugin Vulnerabilities

ShopLentor < 2.6.3 - Settings Update via CSRF

Description

The plugin does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack

Affects Plugins

Plugin icon
woolentor-addons
Fixed in 2.6.3

References

CVE
CVE-2022-47172

Classification

Type
CSRF
OWASP top 10
A2: Broken Authentication and Session Management
CWE
CWE-352
CVSS
4.3 (medium)

Miscellaneous

Original Researcher
Muhammad Daffa
Verified
No
WPVDB ID
4387e33d-d6d4-4137-9ee6-c93e91d0f1bb

Timeline

Publicly Published
2023-07-05 (about 2 years ago)
Added
2023-07-18 (about 2 years ago)
Last Updated
2023-07-18 (about 2 years ago)

Other

Published
Title
Published
2023-12-27
Title
Split Test For Elementor < 1.7.0 - Cross-Site Request Forgery
Published
2025-03-19
Title
Custom Twitter Feeds < 2.3.0 - Cross-Site Request Forgery to Cache Reset via ctf_clear_cache_admin Function
Published
2025-06-19
Title
Knowledge Base – Knowledge Base Maker <= 1.1.8 - Cross-Site Request Forgery
Published
2023-01-19
Title
WP TopBar <= 5.36 - CSRF
Published
2024-12-12
Title
Simple Booking Widget <= 1.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting