WordPress Plugin Vulnerabilities

Woocommerce ESTO < 2.23.2 - Settings Update via CSRF

Description

The plugin does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack

Affects Plugins

Plugin icon
woo-esto
Fixed in 2.23.2

References

CVE
CVE-2023-44260

Classification

Type
CSRF
OWASP top 10
A2: Broken Authentication and Session Management
CWE
CWE-352
CVSS
4.3 (medium)

Miscellaneous

Original Researcher
Nguyen Xuan Chien
Verified
No
WPVDB ID
77f06e9c-8ace-468a-a6a3-891d56bf8745

Timeline

Publicly Published
2023-09-27 (about 2 years ago)
Added
2023-10-11 (about 2 years ago)
Last Updated
2023-10-11 (about 2 years ago)

Other

Published
Title
Published
2025-09-29
Title
LatePoint < 5.2.0 - Account Takeover via CSRF
Published
2023-09-13
Title
10Web Map Builder for Google Maps < 1.0.74 - Cross-Site Request Forgery to Notice Dismissal
Published
2025-06-13
Title
XiSearch bar <= 2.6 - Cross-Site Request Forgery to Stored Cross-Site Scripting
Published
2023-07-05
Title
Media Library Helper by Codexin < 1.3.0 - Cross-Site Request Forgery
Published
2025-04-09
Title
Easy Custom CSS <= 1.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting