WordPress Plugin Vulnerabilities

WooCommerce Extra Cost <= 2.6 - CSRF Bypass

Description

The plugin does not properly check for CSRF in its save_extra_cost method, which might allow attacker to make logged in users call it and perform unwanted actions.

Affects Plugins

Plugin icon
woo-extra-cost
No known fix

Classification

Type
CSRF
OWASP top 10
A2: Broken Authentication and Session Management
CWE
CWE-352
CVSS
4.3 (medium)

Miscellaneous

Original Researcher
WPScanTeam
Verified
Yes
WPVDB ID
51fb34a2-3903-49f4-a6f3-7e02ad7f98b6

Timeline

Publicly Published
2021-07-05 (about 4 years ago)
Added
2021-07-05 (about 4 years ago)
Last Updated
2021-07-05 (about 4 years ago)

Other

Published
Title
Published
2024-10-18
Title
GoogleDrive folder list <= 2.2.2 - Cross-Site Request Forgery to Stored Cross-Site Scripting
Published
2025-11-11
Title
Asgaros Forum < 3.3.0 - Cross-Site Request Forgery to Subscription Settings Update
Published
2025-04-01
Title
Query Wrangler < 1.5.55 - Cross-Site Request Forgery
Published
2025-12-11
Title
Purchase and Expense Manager <= 1.1.2 - Cross-Site Request Forgery to Arbitrary Purchase Record Deletion
Published
2024-06-20
Title
Education Zone < 1.3.5 - Cross-Site Request Forgery to Notice Dismissal