WordPress Plugin Vulnerabilities

Stripe Payments For WooCommerce by Checkout < 1.4.11 - Settings Update via CSRF

Description

The plugin does not have CSRF check when updating its settings, which could allow attackers to make logged in admins perform such action via a CSRF attack

Affects Plugins

Plugin icon
checkout-plugins-stripe-woo
Fixed in 1.4.11

References

CVE
CVE-2023-23865

Classification

Type
CSRF
OWASP top 10
A2: Broken Authentication and Session Management
CWE
CWE-352
CVSS
4.3 (medium)

Miscellaneous

Original Researcher
Lana Codes
Verified
Yes
WPVDB ID
776d0469-787d-4d6f-ba45-d8f54368823d

Timeline

Publicly Published
2023-02-28 (about 3 years ago)
Added
2023-02-28 (about 3 years ago)
Last Updated
2023-02-28 (about 3 years ago)

Other

Published
Title
Published
2022-05-06
Title
PNG to JPG < 4.1 - Stored Cross-Site Scripting via CSRF
Published
2015-06-17
Title
WP-Stats < 2.52 - CSRF to Stored Cross-Site Scripting (XSS)
Published
2024-04-12
Title
eCommerce Product Catalog < 3.3.29 - Cross-Site Request Forgery
Published
2024-03-26
Title
RegistrationMagic < 5.3.1.0 - Cross-Site Request Forgery
Published
2014-12-18
Title
Twitter Liveblog <= 1.1.2 - Multiple CSRF