CVE-2023-6625

2024-01-2220:15:47

CWE-352

[email protected]

web.nvd.nist.gov

cve-2023-6625

product enquiry

woocommerce

wordpress

csrf

security vulnerability

nvd

4.3 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

4.9 Medium

AI Score

Confidence

High

0.0005 Low

EPSS

Percentile

17.1%

JSON

The Product Enquiry for WooCommerce WordPress plugin before 3.1 does not have a CSRF check in place when deleting inquiries, which could allow attackers to make a logged in admin delete them via a CSRF attack

Affected configurations

Vulners

NVD

Node

piwebsolutionproduct_enquiry_for_woocommerceRange<3.1

VendorProductVersionCPE
piwebsolutionproduct_enquiry_for_woocommerce*cpe:2.3:a:piwebsolution:product_enquiry_for_woocommerce:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
piwebsolution	product_enquiry_for_woocommerce	*	cpe:2.3:a:piwebsolution:product_enquiry_for_woocommerce::::::::

CNA Affected

[
  {
    "vendor": "Unknown",
    "product": "Product Enquiry for WooCommerce",
    "versions": [
      {
        "status": "affected",
        "versionType": "semver",
        "version": "0",
        "lessThan": "3.1"
      }
    ],
    "defaultStatus": "unaffected",
    "collectionURL": "https://wordpress.org/plugins"
  }
]