WordPress Plugin Vulnerabilities

Conditional Payments for WooCommerce < 2.3.2 - Plugin RuleSets Activation/Deactivation via CSRF

Description

The plugin does not have CSRF checks when activating and deleting its rulesets, which could allow attackers to make logged in users perform such actions via CSRF attacks

Affects Plugins

Plugin icon
conditional-payments-for-woocommerce
Fixed in 2.3.2

References

CVE
CVE-2022-46805

Classification

Type
CSRF
OWASP top 10
A2: Broken Authentication and Session Management
CWE
CWE-352
CVSS
5.4 (medium)

Miscellaneous

Original Researcher
Cat
Verified
No
WPVDB ID
f96a3b13-7ab9-4811-968b-8e4644555e93

Timeline

Publicly Published
2023-02-14 (about 3 years ago)
Added
2023-03-01 (about 3 years ago)
Last Updated
2023-03-01 (about 3 years ago)

Other

Published
Title
Published
2014-08-01
Title
Sexy Add Template 1.0 - PHP Code Execution CSRF
Published
2025-03-28
Title
OmniLeads Scripts and Tags Manager <= 1.3 - Cross-Site Request Forgery to Stored Cross-Site Scripting
Published
2025-09-05
Title
Woocommerce Notify Updated Product <= 1.6 - Cross-Site Request Forgery to Stored Cross-Site Scripting
Published
2022-05-09
Title
Bulk Page Creator < 1.1.4 - Arbitrary Page Creation via CSRF
Published
2023-09-04
Title
SIS Handball <= 1.0.45 - Settings Update via CSRF