CVE-2022-2382

🗓️ 22 Aug 2022 15:02:20Reported by WPScanType

cve🔗 web.nvd.nist.gov📰️ 4 Media mentions👁 60 Views🌐 WEB

The Product Slider for WooCommerce WordPress plugin before 2.5.7 is vulnerable to CSRF and authorization flaws, allowing authenticated users to perform unauthorized actions

Reporter	Title	Published	Views	Family All 12
ATTACKERKB	CVE-2022-2382	22 Aug 202215:15	–	attackerkb
CNNVD	WordPress plugin Product Slider for WooCommerce 安全漏洞	22 Aug 202200:00	–	cnnvd
Cvelist	CVE-2022-2382 Product Slider for WooCommerce < 2.5.7 - Subscriber+ Arbitrary Options Deletion	22 Aug 202215:02	–	cvelist
EUVD	EUVD-2022-34649	3 Oct 202520:07	–	euvd
NVD	CVE-2022-2382	22 Aug 202215:15	–	nvd
OSV	CVE-2022-2382	22 Aug 202215:15	–	osv
Patchstack	WordPress Product Slider for WooCommerce plugin <= 2.5.6 - Authenticated Arbitrary Options Deletion vulnerability	26 Jul 202200:00	–	patchstack
Prion	Cross site request forgery (csrf)	22 Aug 202215:15	–	prion
Positive Technologies	PT-2022-16283 · WordPress · Product Slider For Woocommerce	22 Aug 202200:00	–	ptsecurity
RedhatCVE	CVE-2022-2382	23 May 202501:01	–	redhatcve

NVD

Vulners

Node

shapedplugin product_slider_for_woocommerceRange<2.5.7wordpress

[
  {
    "product": "Product Slider for WooCommerce",
    "vendor": "Unknown",
    "versions": [
      {
        "lessThan": "2.5.7",
        "status": "affected",
        "version": "2.5.7",
        "versionType": "custom"
      }
    ]
  }
]

Source	Link
wpscan	www.wpscan.com/vulnerability/777d4637-444b-4eda-bc21-95d3a3bf6cd3

Parameter	Position	Path	Description	CWE
action	request body	wp-admin/admin-ajax.php	Flawed CSRF checks and lack of authorization in AJAX actions in the Product Slider for WooCommerce plugin can allow authenticated users (e.g., subscribers) to call admin-ajax.php actions, potentially deleting arbitrary blog options (e.g., via action=spwps-reset&unique=template).	CWE-352, CWE-862
unique	request body	wp-admin/admin-ajax.php	Flawed CSRF checks and lack of authorization in AJAX actions in the Product Slider for WooCommerce plugin can allow authenticated users (e.g., subscribers) to call admin-ajax.php actions, potentially deleting arbitrary blog options (e.g., via action=spwps-reset&unique=template).	CWE-352, CWE-862

21 Nov 2024 07:00Current

4.6Medium risk

Vulners AI Score4.6

CVSS 3.14.3

EPSS0.00097