CVE-2022-4872

WooCommerce Chained Products < 2.12.0 - Unauthenticated Arbitrary Options Update to 'no'

CVSS 4.3 MEDIUMEPSS 0.3%

Vexday Risk Score

13Baixo

Decisão SSVC (CISA)

Track

Sem sinal de exploração → monitorar

CVSS 4.3EPSS 0.3%KEV nãoPoC —Nuclei —Metasploit —Patch —

Ciclo de vida

30 jan 2023Publicada no NVD

Recomendação: Monitorar — sem sinal de exploração no momento.

The Chained Products WordPress plugin before 2.12.0 does not have authorisation and CSRF checks, as well as does not ensure that the option to be updated belong to the plugin, allowing unauthenticated attackers to set arbitrary options to 'no'

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Produtos afetados

Unknown · Chained Products

Referências

https://wpscan.com/vulnerability/c76a1c0b-8a5b-4639-85b6-9eebc63c3aa6