CVE-2022-4107 SMSA Shipping for WooCommerce < 1.0.5 - Subscriber+ Arbitrary File Download

2022-12-1913:41:49

WPScan

www.cve.org

smsa shipping

woocommerce

cve-2022-4107

arbitrary file download

authorization

csrf

validation

EPSS

0.002

Percentile

61.6%

JSON

The SMSA Shipping for WooCommerce WordPress plugin before 1.0.5 does not have authorisation and proper CSRF checks, as well as does not validate the file to be downloaded, allowing any authenticated users, such as subscriber to download arbitrary file from the server

CNA Affected

[
  {
    "vendor": "Unknown",
    "product": "SMSA Shipping for WooCommerce",
    "versions": [
      {
        "status": "affected",
        "versionType": "custom",
        "version": "0",
        "lessThan": "1.0.5"
      }
    ],
    "defaultStatus": "unaffected"
  }
]

References

wpscan.com/vulnerability/0b432858-722c-4bda-aa95-ad48e2097302

EPSS

0.002

Percentile

61.6%

JSON

Related for CVELIST:CVE-2022-4107