9.8

CVE-2022-1020

Exploit

Woo Product Table < 3.1.2 - Unauthenticated Arbitrary Function Call

Product Table for WooCommerce <= 3.1.2 - Missing Authorization

The Product Table for WooCommerce (wooproducttable) WordPress plugin before 3.1.2 does not have authorisation and CSRF checks in the wpt_admin_update_notice_option AJAX action (available to both unauthenticated and authenticated users), as well as does not validate the callback parameter, allowing unauthenticated attackers to call arbitrary functions with either none or one user controlled argument
Mögliche Gegenmaßnahme
Product Table for WooCommerce: Update to version 3.1.3, or a newer patched version
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Codeastrology ≫ Woo Product Table SwPlatformwordpress Version < 3.1.2
Weitere Schwachstelleninformationen
SystemWordPress Plugin
≫
Produkt Product Table for WooCommerce
Version [*, 3.1.2)
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 25.94% 0.978
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
NIST 9.8 3.9 5.9
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
NIST 7.5 10 6.4
AV:N/AC:L/Au:N/C:P/I:P/A:P
CWE-352 Cross-Site Request Forgery (CSRF)

The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor.

CWE-862 Missing Authorization

The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

https://wpscan.com/vulnerability/04fe89b3-8ad1-482f-a96d-759d1d3a0dd5
Third Party Advisory
Exploit
https://www.wordfence.com/threat-intel/vulnerabilities/id/f4494a0f-57fb-4ed7-8fdc-85b5dcee6549
Third Party Advisory