WordPress Plugin Vulnerabilities

Ecwid Ecommerce Shopping Cart < 6.10.24 - Settings Update via CSRF

Description

The plugin does not correctly check for CSRF when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack

Affects Plugins

Plugin icon
ecwid-shopping-cart
Fixed in 6.10.24

References

CVE
CVE-2022-2432
URL
https://www.wordfence.com/blog/2022/08/cross-site-request-forgery-vulnerability-patched-in-ecwid-ecommerce-shopping-cart-plugin/

Classification

Type
CSRF
OWASP top 10
A2: Broken Authentication and Session Management
CWE
CWE-352
CVSS
6.3 (medium)

Miscellaneous

Original Researcher
Marco Wotschka
Verified
Yes
WPVDB ID
6bc83e7b-4f90-40ca-87ee-5051c8dd86c6

Timeline

Publicly Published
2022-08-04 (about 3 years ago)
Added
2022-08-04 (about 3 years ago)
Last Updated
2023-04-12 (about 2 years ago)

Other

Published
Title
Published
2025-08-14
Title
CM On Demand Search And Replace < 1.5.3 - Cross-Site Request Forgery
Published
2025-04-16
Title
Ever Accounting < 2.1.6 - Cross-Site Request Forgery
Published
2024-11-28
Title
CultBooking Hotel Booking Engine <= 2.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting
Published
2024-04-12
Title
Download IP2Location Country Blocker < 2.34.3 - Cross-Site Request Forgery
Published
2025-04-01
Title
Clearbit Reveal <= 1.0.6 - Cross-Site Request Forgery