WordPress Plugin Vulnerabilities

WooCommerce Ship to Multiple Addresses < 3.8.6 - Billing Address Update via CSRF

Description

The plugin does not have CSRF check when updating billing addresses, which could allow attackers to make logged in users perform such action via a CSRF attack

Affects Plugins

Plugin icon
woocommerce-shipping-multiple-addresses
Fixed in 3.8.6

References

CVE
CVE-2023-36514

Classification

Type
CSRF
OWASP top 10
A2: Broken Authentication and Session Management
CWE
CWE-352
CVSS
4.3 (medium)

Miscellaneous

Original Researcher
Rafie Muhammad
Verified
No
WPVDB ID
e6f045d5-3514-43df-a0a8-6a5ac2773e73

Timeline

Publicly Published
2023-06-26 (about 2 years ago)
Added
2023-08-07 (about 2 years ago)
Last Updated
2023-08-07 (about 2 years ago)

Other

Published
Title
Published
2025-09-05
Title
Compact Admin <= 1.3.0 - Cross-Site Request Forgery
Published
2023-05-15
Title
WooCommerce Product Add-ons < 6.2.0 - Cross-Site Request Forgery
Published
2024-03-29
Title
LWS Optimize < 2.0 - Cross-Site Request Forgery
Published
2025-04-04
Title
Libro de Reclamaciones y Quejas <= 1.0 - Stored XSS via CSRF
Published
2024-11-22
Title
Continue Shopping From Cart <= 1.3 - Cross-Site Request Forgery to Stored Cross-Site Scripting