WordPress Plugin Vulnerabilities

ЮKassa для WooCommerce < 2.3.1 - Arbitrary Settings Update via CSRF

Description

The plugin does not have CSRF check in place when updating its settings, which could allow attackers to make any logged in user (due the the lack of authorisation as well) change them via a CSRF attack

Affects Plugins

Plugin icon
yookassa
Fixed in 2.3.1

References

CVE
CVE-2022-36379

Classification

Type
CSRF
OWASP top 10
A2: Broken Authentication and Session Management
CWE
CWE-352
CVSS
4.3 (medium)

Miscellaneous

Original Researcher
ptsfence
Verified
No
WPVDB ID
cde76060-b3b4-44bf-9afd-b6422deaabf6

Timeline

Publicly Published
2022-07-28 (about 3 years ago)
Added
2022-08-24 (about 3 years ago)
Last Updated
2023-05-17 (about 2 years ago)

Other

Published
Title
Published
2023-10-16
Title
Feed Statistics <= 4.1 - Arbitrary Settings Update via CSRF
Published
2025-03-11
Title
W3Counter Free Real-Time Web Stats <= 4.1 - Cross-Site Request Forgery
Published
2025-01-24
Title
Sticky Buttons < 4.1.2 - Cross-Site Request Forgery to Settings Update
Published
2025-05-07
Title
Contribuinte Checkout < 2.0.04 - Stored XSS via CSRF
Published
2024-03-28
Title
WPCS < 1.2.0.2 - Cross-Site Request Forgery