Privilege escalation

The All in One B2B for WooCommerce WordPress plugin through 1.0.3 does not properly validate parameters when updating user details, allowing an unauthenticated attacker to update the details of any user. Updating the password of an Admin user leads to privilege escalation...

WordPress plugin All in One B2B for WooCommerce security vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A security vulnerability exists in the...

CVE-2023-3547

CVE-2023-3547 affects All in One B2B for WooCommerce (WordPress plugin) up to version 1.0.3. Affected component: nonce validation in multiple actions, leading to Cross-Site Request Forgery (CSRF) exploitation. Impact metrics show high confidentiality, integrity, and availability risk (CVSS 3.1: H...

PT-2023-25219 · WordPress · All In One B2B For Woocommerce

Name of the Vulnerable Software and Affected Versions: All in One B2B for WooCommerce WordPress plugin versions 1.0.3 and earlier Description: The issue allows an attacker to perform CSRF attacks due to improper checking of nonce values in several actions. Recommendations: For All in One B2B for...

All in One B2B for WooCommerce <= 1.0.3 - Multiple CSRF

Description The plugin does not properly check nonce values in several actions, allowing an attacker to perform CSRF attacks. This CSRF attack will reject a Quote in the database. 1. Go to All In One Quote Quotes 2. Click "Add quote", fill in the title, and save. 3. Find the Quote ID, convert it ...