WordPress Plugin Vulnerabilities

Waitlist Woocommerce < 2.5.3 - Settings Reset via CSRF

Description

The plugin does not have CSRF check when reseting its Settings, which could allow attackers to make logged in admins perform such action via a CSRF attack

Proof of Concept

Affects Plugins

Plugin icon
waitlist-woocommerce
Fixed in 2.5.3

Classification

Type
CSRF
OWASP top 10
A2: Broken Authentication and Session Management
CWE
CWE-352
CVSS
4.3 (medium)

Miscellaneous

Verified
Yes
WPVDB ID
9d0192b8-b4ea-41c8-9b46-bcf177c7c67c

Timeline

Publicly Published
2023-07-03 (about 2 years ago)
Added
2023-07-03 (about 2 years ago)
Last Updated
2023-07-03 (about 2 years ago)

Other

Published
Title
Published
2025-01-27
Title
Post Carousel Slider <= 2.0.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting
Published
2023-04-05
Title
YourChannel < 1.2.5 - Multiple CSRF
Published
2024-10-21
Title
EKC Tournament Manager < 2.2.2 - Cross-Site Request Forgery to Arbitrary File Upload
Published
2023-02-17
Title
Podlove Podcast Publisher <= 3.8.3 - Cross-Site Request Forgery
Published
2024-04-22
Title
Royal Elementor Kit < 1.0.117 - Cross-Site Request Forgery to Notice Dismissal