CVE-2021-34619

🗓️ 21 Jul 2021 11:09:37Reported by WordfenceType

cve🔗 web.nvd.nist.gov📰️ 2 Media mentions👁 59 Views🌐 WEB

WooCommerce Stock Manager plugin v2.5.7 CSRF vulnerability allows Arbitrary File Uploa

Reporter	Title	Published	Views	Family All 15
ATTACKERKB	CVE-2021-34619	14 Jun 202104:00	–	attackerkb
BDU FSTEC	The vulnerability lies in the implementation of the /woocommerce-stock-manager/trunk/admin/views/import-export.php function, which handles import/export operations for the WooCommerce Stock Manager plugin. This plugin is a content management system for WordPress websites. An attacker can exploit this vulnerability to perform a CSRF attack.	15 Sep 202100:00	–	bdu_fstec
Circl	CVE-2021-34619	19 Jun 202612:48	–	circl
CNNVD	WordPress 跨站请求伪造漏洞	21 Jul 202100:00	–	cnnvd
CNVD	WordPress Cross-site Request Forgery Vulnerability (CNVD-2021-59587)	27 Jul 202100:00	–	cnvd
Cvelist	CVE-2021-34619 Cross-Site Request Forgery in WooCommerce Stock Manager WordPress Plugin	21 Jul 202111:09	–	cvelist
EUVD	EUVD-2021-21269	7 Oct 202500:30	–	euvd
NVD	CVE-2021-34619	21 Jul 202115:16	–	nvd
OSV	CVE-2021-34619	21 Jul 202115:16	–	osv
Patchstack	WordPress WooCommerce Stock Manager plugin <= 2.5.7 - Cross-Site Request Forgery (CSRF) vulnerability leading to Arbitrary File Upload	14 Jun 202100:00	–	patchstack

NVD

Vulners

Node

storeapps stock_manager_for_woocommerceRange≤2.5.7wordpress

[
  {
    "product": "WooCommerce Stock Manager",
    "vendor": "StoreApps",
    "versions": [
      {
        "lessThanOrEqual": "2.5.7",
        "status": "affected",
        "version": "2.5.7",
        "versionType": "custom"
      }
    ]
  }
]

Source	Link
plugins	www.plugins.trac.wordpress.org/browser/woocommerce-stock-manager/trunk/admin/views/import-export.php
wordfence	www.wordfence.com/blog/2021/06/high-severity-vulnerability-patched-in-woocommerce-stock-manager-plugin/

Parameter	Position	Path	Description	CWE
uploadFile	request body	wp-admin/admin.php?page=stock-manager-import-export	CSRF leads to Arbitrary File Upload in WooCommerce Stock Manager via missing nonce and file validation in the import-export endpoint.	CWE-352, CWE-434
upload	request body	wp-admin/admin.php?page=stock-manager-import-export	CSRF leads to Arbitrary File Upload in WooCommerce Stock Manager via missing nonce and file validation in the import-export endpoint.	CWE-352, CWE-434

17 Jun 2026 03:56Current

8.7High risk

Vulners AI Score8.7

CVSS 26.8

CVSS 3.18.8

EPSS0.00719