WordPress Plugin Vulnerabilities

Woo MerchantX <= 1.0 - CSRF Bypass

Description

The plugin does not properly check for CSRF in its merchantx_stepOne_addBilling, merchantx_stepOne and merchantx_deletePaymentMethod functions, allowing attacker to make logged in users call them and perform unwanted actions.

Affects Plugins

Plugin icon
woo-merchantx
No known fix

Classification

Type
CSRF
OWASP top 10
A2: Broken Authentication and Session Management
CWE
CWE-352
CVSS
5.4 (medium)

Miscellaneous

Original Researcher
WPScanTeam
Verified
Yes
WPVDB ID
c6ec6b54-ac22-4c5f-89de-2ce0f943eb9f

Timeline

Publicly Published
2021-07-05 (about 4 years ago)
Added
2021-07-05 (about 4 years ago)
Last Updated
2021-07-05 (about 4 years ago)

Other

Published
Title
Published
2024-10-24
Title
DarkMySite – Advanced Dark Mode Plugin for WordPress <= 1.2.8 - Cross-Site Request Forgery
Published
2022-07-26
Title
WP Coder < 2.5.3 - Code Deletion via CSRF
Published
2021-08-16
Title
Opal Estate <= 1.6.11 - Cross-Site Request Forgery
Published
2025-09-10
Title
PhpList Subber <= 1.1 - Cross-Site Request Forgery
Published
2022-09-26
Title
WP Page Widget < 4.0 - Settings Update via CSRF