CVE-2021-34619

🗓️ 21 Jul 2021 11:09:37Reported by WordfenceType

cve🔗 web.nvd.nist.gov📰️ 2 Media mentions👁 45 Views🌐 WEB

WooCommerce Stock Manager plugin v2.5.7 CSRF vulnerability allows Arbitrary File Uploa

Reporter	Title	Published	Views	Family All 14
BDU FSTEC	The vulnerability lies in the implementation of the /woocommerce-stock-manager/trunk/admin/views/import-export.php function, which handles import/export operations for the WooCommerce Stock Manager plugin. This plugin is a content management system for WordPress websites. An attacker can exploit this vulnerability to perform a CSRF attack.	15 Sep 202100:00	–	bdu_fstec
Circl	CVE-2021-34619	19 Jun 202612:48	–	circl
CNNVD	WordPress 跨站请求伪造漏洞	21 Jul 202100:00	–	cnnvd
CNVD	WordPress Cross-site Request Forgery Vulnerability (CNVD-2021-59587)	27 Jul 202100:00	–	cnvd
Cvelist	CVE-2021-34619 Cross-Site Request Forgery in WooCommerce Stock Manager WordPress Plugin	21 Jul 202111:09	–	cvelist
EUVD	EUVD-2021-21269	7 Oct 202500:30	–	euvd
NVD	CVE-2021-34619	21 Jul 202115:16	–	nvd
OSV	CVE-2021-34619	21 Jul 202115:16	–	osv
Patchstack	WordPress WooCommerce Stock Manager plugin <= 2.5.7 - Cross-Site Request Forgery (CSRF) vulnerability leading to Arbitrary File Upload	14 Jun 202100:00	–	patchstack
Prion	Cross site request forgery (csrf)	21 Jul 202115:16	–	prion

NVD

Vulners

Node

storeapps stock_manager_for_woocommerceRange≤2.5.7wordpress

[
  {
    "product": "WooCommerce Stock Manager",
    "vendor": "StoreApps",
    "versions": [
      {
        "lessThanOrEqual": "2.5.7",
        "status": "affected",
        "version": "2.5.7",
        "versionType": "custom"
      }
    ]
  }
]

Source	Link
plugins	www.plugins.trac.wordpress.org/browser/woocommerce-stock-manager/trunk/admin/views/import-export.php
wordfence	www.wordfence.com/blog/2021/06/high-severity-vulnerability-patched-in-woocommerce-stock-manager-plugin/

Parameter	Position	Path	Description	CWE
uploadFile	path	/woocommerce-stock-manager/trunk/admin/views/import-export.php	CSRF leads to arbitrary file upload via import-export endpoint in WooCommerce Stock Manager (unauthorized file upload without nonce/validation)	CWE-434, CWE-352
upload	path	/woocommerce-stock-manager/trunk/admin/views/import-export.php	CSRF leads to arbitrary file upload via import-export endpoint in WooCommerce Stock Manager (unauthorized file upload without nonce/validation)	CWE-434, CWE-352
uploadFile	path	/admin/views/import-export.php	CSRF leads to arbitrary file upload via admin import-export view (unauthorized file upload without nonce/validation)	CWE-434, CWE-352
upload	path	/admin/views/import-export.php	CSRF leads to arbitrary file upload via admin import-export view (unauthorized file upload without nonce/validation)	CWE-434, CWE-352
PoC.php	path	/wp-content/plugins/woocommerce-stock-manager/admin/views/upload/PoC.php	PoC file upload path demonstrating arbitrary file upload capability	CWE-434, CWE-352

17 Jun 2026 03:56Current

8.7High risk

Vulners AI Score8.7

CVSS 26.8

CVSS 3.18.8

EPSS0.00719