Lucene search
HistoryAug 22, 2022 - 3:15 p.m.
CVE-2022-2555
yotpo reviews
csrf
wordpress plugin
woocommerce
nonce check
cve-2022-2555
CVSS3
6.5
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
REQUIRED
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
HIGH
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
EPSS
0.001
Percentile
26.3%
The Yotpo Reviews for WooCommerce WordPress plugin through 2.0.4 lacks nonce check when updating its settings, which could allow attacker to make a logged in admin change them via a CSRF attack.
Affected configurations
Node
yotpo_reviews_for_woocommerce_projectyotpo_reviews_for_woocommerceRange≤2.0.4wordpress
| Vendor | Product | Version | CPE |
|---|---|---|---|
| yotpo_reviews_for_woocommerce_project | yotpo_reviews_for_woocommerce | * | cpe:2.3:a:yotpo_reviews_for_woocommerce_project:yotpo_reviews_for_woocommerce:*:*:*:*:*:wordpress:*:* |
Related
prion
prion
Cross site request forgery (csrf)
2022-08-22 15:15:00
cvelist
cvelist
cve
cve
CVE-2022-2555
2022-08-22 15:15:15
patchstack
patchstack
CVSS3
6.5
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
REQUIRED
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
HIGH
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
EPSS
0.001
Percentile
26.3%
Related for NVD:CVE-2022-2555