CVE-2022-2382 Product Slider for WooCommerce < 2.5.7 - Subscriber+ Arbitrary Options Deletion

2022-08-2215:02:20

CWE-862

CWE-352

WPScan

www.cve.org

5 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

21.4%

JSON

The Product Slider for WooCommerce WordPress plugin before 2.5.7 has flawed CSRF checks and lack authorisation in some of its AJAX actions, allowing any authenticated users, such as subscriber to call them. One in particular could allow them to delete arbitrary blog options.

CNA Affected

[
  {
    "product": "Product Slider for WooCommerce",
    "vendor": "Unknown",
    "versions": [
      {
        "lessThan": "2.5.7",
        "status": "affected",
        "version": "2.5.7",
        "versionType": "custom"
      }
    ]
  }
]