CVE-2022-3999 WooCommerce Shipping - DPD baltic < 1.2.57 - Subscriber+ Arbitrary Options Deletion

2022-12-1217:54:49

WPScan

www.cve.org

cve-2022-3999

woocommerce shipping

dpd baltic

vulnerability

wordpress plugin

csrf

ajax

arbitrary options deletion

authentication issue

blog unavailability

8.2 High

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

20.2%

JSON

The DPD Baltic Shipping WordPress plugin before 1.2.57 does not have authorisation and CSRF in an AJAX action, which could allow any authenticated users, such as subscriber to delete arbitrary options from the blog, which could make the blog unavailable.

CNA Affected

[
  {
    "vendor": "Unknown",
    "product": "DPD Baltic Shipping",
    "versions": [
      {
        "status": "affected",
        "versionType": "custom",
        "version": "0",
        "lessThan": "1.2.57"
      }
    ],
    "defaultStatus": "unaffected",
    "collectionURL": "https://wordpress.org/plugins"
  }
]