WordPress Plugin Vulnerabilities

RestroPress < 2.8.3 - Cart Manipulation via CSRF

Description

The plugin does not properly check for CSRF in some of its AJAX calls, allowing attackers to make users do unwanted actions, such as add arbitrary products to their cart, or empty it completely

Proof of Concept

Affects Plugins

Plugin icon
restropress
Fixed in 2.8.3

Classification

Type
CSRF
OWASP top 10
A2: Broken Authentication and Session Management
CWE
CWE-352
CVSS
4.3 (medium)

Miscellaneous

Original Researcher
WPScanTeam
Verified
Yes
WPVDB ID
77f28abe-393d-47f6-a00a-498662bf5df8

Timeline

Publicly Published
2021-07-19 (about 4 years ago)
Added
2021-07-19 (about 4 years ago)
Last Updated
2021-07-19 (about 4 years ago)

Other

Published
Title
Published
2014-08-01
Title
foursquare-checkins - CSRF
Published
2024-02-26
Title
Categorify < 1.0.7.5 - Cross-Site Request Forgery via categorifyAjaxClearCategory
Published
2024-12-12
Title
DTC Documents <= 1.1.05 - Cross-Site Request Forgery
Published
2025-04-04
Title
WP Zendesk for Contact Form 7, WPForms, Elementor, Formidable and Ninja Forms < 1.1.4 - Cross-Site Request Forgery
Published
2025-01-16
Title
GravatarLocalCache <= 1.1.2 - Cross-Site Request Forgery to Stored Cross-Site Scripting