CVE-2022-4888

2023-07-3110:15:09

[email protected]

web.nvd.nist.gov

wordpress

plugins

csrf

attackers

unauthorized actions

CVSS3

6.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

EPSS

0.001

Percentile

30.5%

JSON

The Checkout Fields Manager WordPress plugin before 1.0.2, Abandoned Cart Recovery WordPress plugin before 1.2.5, Custom Fields for WooCommerce WordPress plugin before 1.0.4, Custom Order Number WordPress plugin through 1.0.1, Custom Registration Forms Builder WordPress plugin before 1.0.2, Advanced Free Gifts WordPress plugin before 1.0.2, Gift Registry for WooCommerce WordPress plugin through 1.0.1, Image Watermark for WooCommerce WordPress plugin before 1.0.1, Order Approval for WooCommerce WordPress plugin before 1.1.0, Order Tracking for WooCommerce WordPress plugin before 1.0.2, Price Calculator for WooCommerce WordPress plugin through 1.0.3, Product Dynamic Pricing and Discounts WordPress plugin through 1.0.6, Product Labels and Stickers WordPress plugin through 1.0.1 have flawed CSRF checks in various places, which could allow attackers to make logged in users perform unwanted actions

Affected configurations

Nvd

Node

addifyabandoned_cart_recoveryRange<1.2.5wordpress

addifyadvanced_free_giftsRange<1.0.2wordpress

addifycheckout_fields_managerRange<1.0.2wordpress

addifycustom_fields_for_woocommerceRange<1.0.4wordpress

addifycustom_order_numberRange≤1.0.1wordpress

addifycustom_registration_forms_builderRange<1.0.2wordpress

addifygift_registry_for_woocommerceRange≤1.0.1wordpress

addifyimage_watermark_for_woocommerceRange≤1.0.1wordpress

addifyorder_approval_for_woocommerceRange<1.1.0wordpress

addifyorder_tracking_for_woocommerceRange<1.0.2wordpress

VendorProductVersionCPE
addifyabandoned_cart_recovery*cpe:2.3:a:addify:abandoned_cart_recovery:*:*:*:*:*:wordpress:*:*
addifyadvanced_free_gifts*cpe:2.3:a:addify:advanced_free_gifts:*:*:*:*:*:wordpress:*:*
addifycheckout_fields_manager*cpe:2.3:a:addify:checkout_fields_manager:*:*:*:*:*:wordpress:*:*
addifycustom_fields_for_woocommerce*cpe:2.3:a:addify:custom_fields_for_woocommerce:*:*:*:*:*:wordpress:*:*
addifycustom_order_number*cpe:2.3:a:addify:custom_order_number:*:*:*:*:*:wordpress:*:*
addifycustom_registration_forms_builder*cpe:2.3:a:addify:custom_registration_forms_builder:*:*:*:*:*:wordpress:*:*
addifygift_registry_for_woocommerce*cpe:2.3:a:addify:gift_registry_for_woocommerce:*:*:*:*:*:wordpress:*:*
addifyimage_watermark_for_woocommerce*cpe:2.3:a:addify:image_watermark_for_woocommerce:*:*:*:*:*:wordpress:*:*
addifyorder_approval_for_woocommerce*cpe:2.3:a:addify:order_approval_for_woocommerce:*:*:*:*:*:wordpress:*:*
addifyorder_tracking_for_woocommerce*cpe:2.3:a:addify:order_tracking_for_woocommerce:*:*:*:*:*:wordpress:*:*

Vendor	Product	Version	CPE
addify	abandoned_cart_recovery	*	cpe:2.3:a:addify:abandoned_cart_recovery::::::wordpress::*
addify	advanced_free_gifts	*	cpe:2.3:a:addify:advanced_free_gifts::::::wordpress::*
addify	checkout_fields_manager	*	cpe:2.3:a:addify:checkout_fields_manager::::::wordpress::*
addify	custom_fields_for_woocommerce	*	cpe:2.3:a:addify:custom_fields_for_woocommerce::::::wordpress::*
addify	custom_order_number	*	cpe:2.3:a:addify:custom_order_number::::::wordpress::*
addify	custom_registration_forms_builder	*	cpe:2.3:a:addify:custom_registration_forms_builder::::::wordpress::*
addify	gift_registry_for_woocommerce	*	cpe:2.3:a:addify:gift_registry_for_woocommerce::::::wordpress::*
addify	image_watermark_for_woocommerce	*	cpe:2.3:a:addify:image_watermark_for_woocommerce::::::wordpress::*
addify	order_approval_for_woocommerce	*	cpe:2.3:a:addify:order_approval_for_woocommerce::::::wordpress::*
addify	order_tracking_for_woocommerce	*	cpe:2.3:a:addify:order_tracking_for_woocommerce::::::wordpress::*