4.3
CVE-2024-1489
- EPSS 0.11%
- Veröffentlicht 13.03.2024 16:15:23
- Zuletzt bearbeitet 03.04.2025 13:13:02
- Quelle security@wordfence.com
- CVE-Watchlists
- Unerledigt
LoginSMS Alert Order Notifications – WooCommerce <= 3.6.9 - Cross-Site Request Forgery
The SMS Alert Order Notifications – WooCommerce plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.6.9. This is due to missing or incorrect nonce validation on the processBulkAction function. This makes it possible for unauthenticated attackers to delete pages and posts via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Mögliche Gegenmaßnahme
SMS Alert Order Notifications – WooCommerce: Update to version 3.7.0, or a newer patched version
Weitere Schwachstelleninformationen
SystemWordPress Plugin
≫
Produkt
SMS Alert Order Notifications – WooCommerce
Version
*-3.6.9
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Cozyvision ≫ Sms Alert Order Notifications SwPlatformwordpress Version < 3.7.0
| Typ | Quelle | Score | Percentile |
|---|---|---|---|
| EPSS | FIRST.org | 0.11% | 0.305 |
| Quelle | Base Score | Exploit Score | Impact Score | Vector String |
|---|---|---|---|---|
| security@wordfence.com | 4.3 | 2.8 | 1.4 |
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
|
CWE-352 Cross-Site Request Forgery (CSRF)
The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request.