WordPress Plugin Vulnerabilities

WooCommerce Chained Products < 2.12.0 - Unauthenticated Arbitrary Options Update to 'no'

Description

The plugin does not have authorisation and CSRF checks, as well as does not ensure that the option to be updated belong to the plugin, allowing unauthenticated attackers to set arbitrary options to 'no'

Proof of Concept

As unauthenticated, open the following URL to set the Blog Name to 'no': https://example.com/wp-admin/admin-post.php?cp_dismiss_admin_notice=1&option_name=blogname

Affects Plugins

Plugin icon
woocommerce-chained-products
Fixed in 2.12.0

References

CVE
CVE-2022-4872

Classification

Type
NO AUTHORISATION
OWASP top 10
A5: Broken Access Control
CWE
CWE-862
CVSS
5.3 (medium)

Miscellaneous

Original Researcher
WPScan
Verified
Yes
WPVDB ID
c76a1c0b-8a5b-4639-85b6-9eebc63c3aa6

Timeline

Publicly Published
2023-01-04 (about 11 months ago)
Added
2023-01-04 (about 11 months ago)
Last Updated
2023-01-04 (about 11 months ago)

Other

Published
Title
Published
2023-10-11
Title
WordPress Backup & Migration < 1.4.2 - Missing Authorization to Settings and Schedule Modification
Published
2023-12-04
Title
WP Booking System < 2.0.19.3 - Missing Authorization
Published
2023-11-21
Title
UserPro < 5.1.2 - Missing Authorization via multiple functions
Published
2023-12-06
Title
System Dashboard < 2.8.8 - Missing Authorization to Information Disclosure (sd_global_value)
Published
2023-10-24
Title
WP EXtra < 6.3 - Subscriber+ .htaccess File Modification