WordPress Plugin Vulnerabilities

워드프레스 결제 심플페이 < 5.3.3 - Cross-Site Request Forgery

Description

The plugin is vulnerable to Cross-Site Request Forgery due to missing or incorrect nonce validation on a function. This makes it possible for unauthenticated attackers to perform an unauthorized action granted they can trick a site administrator into performing an action such as clicking on a link.

Affects Plugins

Plugin icon
pgall-for-woocommerce
Fixed in 5.3.3

References

CVE
CVE-2025-47661
URL
https://patchstack.com/database/wordpress/plugin/pgall-for-woocommerce/vulnerability/wordpress-5-2-11-cross-site-request-forgery-csrf-vulnerability

Classification

Type
CSRF
OWASP top 10
A2: Broken Authentication and Session Management
CWE
CWE-352
CVSS
4.3 (medium)

Miscellaneous

Original Researcher
Nguyen Xuan Chien
Verified
No
WPVDB ID
f9acab01-1801-4fe9-a345-5731affc553e

Timeline

Publicly Published
2025-05-07 (about 1 year ago)
Added
2025-05-12 (about 1 year ago)
Last Updated
2025-05-23 (about 1 year ago)

Other

Published
Title
Published
2025-04-04
Title
Official CleverReach Plugin for WooCommerce < 3.4.7 - Settings Update via CSRF
Published
2024-06-18
Title
Photo Gallery, Images, Slider in Rbs Image Gallery < 3.2.20 - Cross-Site Request Forgery to Post Creation and Limited Data Loss
Published
2025-01-06
Title
Bus Ticket Booking with Seat Reservation < 5.4.4 - Cross-Site Request Forgery
Published
2023-11-16
Title
Leadster < 1.1.3 - Cross-Site Request Forgery via leadster_script_code_action
Published
2025-04-17
Title
illow – Cookies Consent <= 0.2.0 - Cross-Site Request Forgery