WordPress Plugin Vulnerabilities

WP EasyCart < 5.4.9 - Product Deletion via CSRF

Description

The plugin does not properly implement nonce validation on the process_delete_product function, leading to a Cross-Site Request Forgery vulnerability.

Affects Plugins

Plugin icon
wp-easycart
Fixed in 5.4.9

References

CVE
CVE-2023-2891

Miscellaneous

Original Researcher
Alex Thomas
Verified
No
WPVDB ID
65e0ed92-1738-4c8e-9ae8-d09128fd3437

Timeline

Publicly Published
2023-05-27 (about 2 years ago)
Added
2023-06-09 (about 2 years ago)
Last Updated
2023-06-09 (about 2 years ago)

Other

Published
Title
Published
2017-08-16
Title
AddToAny Share Buttons <= 1.7.14 - Conditional Host Header Injection
Published
2018-08-16
Title
Export Users to CSV <= 1.1.1 - CSV Injection
Published
2014-08-01
Title
RokBox <= 2.13 - rokbox.php Direct Request Path Disclosure
Published
2015-08-05
Title
WordPress <= 4.2.3 - Timing Side Channel Attack
Published
2020-02-26
Title
Export Users to CSV <= 1.4.2 - CSV Injection