CVE-2022-3923 ActiveCampaign for WooCommerce < 1.9.8 - Subscriber+ Error Log Cleanup

2023-01-0922:13:35

WPScan

www.cve.org

activecampaign

woocommerce

wordpress

authorization

error logs

4.9 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

23.5%

JSON

The ActiveCampaign for WooCommerce WordPress plugin before 1.9.8 does not have authorisation check when cleaning up its error logs via an AJAX action, which could allow any authenticated users, such as subscriber to call it and remove error logs.

CNA Affected

[
  {
    "vendor": "Unknown",
    "product": "ActiveCampaign for WooCommerce",
    "versions": [
      {
        "status": "affected",
        "versionType": "custom",
        "version": "0",
        "lessThan": "1.9.8"
      }
    ],
    "defaultStatus": "unaffected",
    "collectionURL": "https://wordpress.org/plugins"
  }
]