WordPress Plugin Vulnerabilities

WooCommerce < 8.3.0 - Cross-Site Request Forgery

Description

The plugin does not have CSRF checks in some places, which could allow attackers to make logged in users perform unwanted actions via CSRF attacks.

Affects Plugins

Plugin icon
woocommerce
Fixed in 8.3.0

References

CVE
CVE-2023-52222
URL
https://patchstack.com/database/vulnerability/woocommerce/wordpress-woocommerce-plugin-8-2-2-cross-site-request-forgery-csrf-vulnerability

Classification

Type
CSRF
OWASP top 10
A2: Broken Authentication and Session Management
CWE
CWE-352
CVSS
4.3 (medium)

Miscellaneous

Original Researcher
Rafie Muhammad
Verified
No
WPVDB ID
d11e7996-3417-4b1b-a090-2f4d31cdd11d

Timeline

Publicly Published
2024-01-05 (about 2 years ago)
Added
2024-01-12 (about 2 years ago)
Last Updated
2024-01-12 (about 2 years ago)

Other

Published
Title
Published
2024-12-12
Title
Like in Vk.com <= 0.5.2 - Cross-Site Request Forgery to Stored Cross-Site Scripting
Published
2024-04-26
Title
FameTheme Demo Importer < 1.1.6 - Cross-Site Request Forgery
Published
2023-12-27
Title
GS Logo Slider < 3.5.2 - Cross-Site Request Forgery
Published
2024-01-03
Title
Custom User CSS <= 0.2 - Settings Update via CSRF
Published
2024-04-10
Title
Product Input Fields for WooCommerce < 1.8.0 - Cross-Site Request Forgery to Notice Dismissal