6.5

CVE-2023-3507

Exploit

WooCommerce Pre-Orders < 2.0.3 - Arbitrary Pre-Order Canceling via CSRF

WooCommerce Pre-Orders <= 2.0.2 - Cross-Site Request Forgery to Order Cancellation

The WooCommerce Pre-Orders WordPress plugin before 2.0.3 has a flawed CSRF check when canceling pre-orders, which could allow attackers to make logged in admins cancel arbitrary pre-orders via a CSRF attack
Mögliche Gegenmaßnahme
WooCommerce Pre-Orders: Update to version 2.0.3, or a newer patched version
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Woocommerce ≫ Woocommerce Pre-orders SwPlatform wordpress Version < 2.0.3
Weitere Schwachstelleninformationen
SystemWordPress Plugin
≫
Produkt WooCommerce Pre-Orders
Version *-2.0.2
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.31% 0.23
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
NIST 6.5 2.8 3.6
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
CISA-ADP 6.5 2.8 3.6
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
Es wurden noch keine Informationen zu CWE veröffentlicht.
https://wpscan.com/vulnerability/e72bbe9b-e51d-40ab-820d-404e0cb86ee6
Third Party Advisory
Exploit
https://www.wordfence.com/threat-intel/vulnerabilities/id/14e6e06c-edc0-44ef-ba07-50fcfc4fd7b1
Third Party Advisory