CVE-2023-2891

CVE-2023-2891 affects the WP EasyCart WordPress plugin prior to version 5.4.9. The issue is a Cross-Site Request Forgery in the process_delete_product function due to missing nonce validation, allowing unauthenticated attackers to delete products via forged requests if they can trick an admin. Th...

CVE-2023-2891 WP EasyCart <= 5.4.8 - Cross-Site Request Forgery via process_delete_product

The WP EasyCart plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 5.4.8. This is due to missing or incorrect nonce validation on the processdeleteproduct function. This makes it possible for unauthenticated attackers to delete products via a forged...

PT-2023-22049 · Unknown · Wp Easycart

Name of the Vulnerable Software and Affected Versions: WP EasyCart plugin for WordPress versions up to, and including, 5.4.8 Description: The issue is related to Cross-Site Request Forgery due to missing or incorrect nonce validation on the process bulk activate product function. This allows...

PT-2023-22038 · WordPress · Wp Easycart

Name of the Vulnerable Software and Affected Versions: WP EasyCart plugin for WordPress versions up to, and including, 5.4.8 Description: The issue is due to missing or incorrect nonce validation on the process bulk delete product function, making it possible for unauthenticated attackers to bulk...

WordPress plugin WP EasyCart 跨站请求伪造漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site request forger...

WordPress plugin WP EasyCart 跨站请求伪造漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site request forger...

PT-2023-22053 · WordPress · Wp Easycart

Name of the Vulnerable Software and Affected Versions: WP EasyCart plugin for WordPress versions up to, and including, 5.4.8 Description: The issue is related to Cross-Site Request Forgery due to missing or incorrect nonce validation on the process duplicate product function. This allows...

WordPress plugin WP EasyCart 跨站请求伪造漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site request forger...

WordPress plugin WP EasyCart 跨站请求伪造漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site request forger...

WordPress Plugin WP EasyCart 跨站请求伪造漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site request forger...

WordPress WP EasyCart Plugin <= 5.4.8 is vulnerable to Cross Site Request Forgery (CSRF)

Software WP EasyCart Type Plugin Vulnerable versions = 5.4.8 Fixed in 5.4.9 OWASP Top 10 A5: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2023-2891 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID c204f4284cba Credits Alex Thomas Required...

WordPress WP EasyCart Plugin <= 5.4.8 is vulnerable to Cross Site Request Forgery (CSRF)

Software WP EasyCart Type Plugin Vulnerable versions = 5.4.8 Fixed in 5.4.9 OWASP Top 10 A5: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2023-2896 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID 38d3a2d175fc Credits Alex Thomas Required...

WordPress WP EasyCart Plugin <= 5.4.8 is vulnerable to Cross Site Request Forgery (CSRF)

Software WP EasyCart Type Plugin Vulnerable versions = 5.4.8 Fixed in 5.4.9 OWASP Top 10 A5: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2023-2893 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID 19dd266af427 Credits Alex Thomas Required...

WordPress WP EasyCart Plugin <= 5.4.8 is vulnerable to Cross Site Request Forgery (CSRF)

Software WP EasyCart Type Plugin Vulnerable versions = 5.4.8 Fixed in 5.4.9 OWASP Top 10 A5: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2023-2894 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID 21eef62f4a85 Credits Alex Thomas Required...

WordPress WP EasyCart Plugin <= 5.4.8 is vulnerable to Cross Site Request Forgery (CSRF)

Software WP EasyCart Type Plugin Vulnerable versions = 5.4.8 Fixed in 5.4.9 OWASP Top 10 A5: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2023-2892 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 185550c7225a Credits Alex Thomas Required...

WordPress WP EasyCart Plugin <= 5.4.8 is vulnerable to Cross Site Request Forgery (CSRF)

Software WP EasyCart Type Plugin Vulnerable versions = 5.4.8 Fixed in 5.4.9 OWASP Top 10 A5: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2023-2895 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID a60a1e37ef26 Credits Alex Thomas Required...

WP EasyCart < 5.4.9 - Multiple CSRFs

The plugin does not apply proper nonce validation routines in multiple AJAX requests, which makes it possible for attackers to trick an unsuspecting administrator into activating and deactivating products...

WP EasyCart < 5.4.9 - Product Deletion via CSRF

The plugin does not properly implement nonce validation on the processdeleteproduct function, leading to a Cross-Site Request Forgery vulnerability...

WordPress WP EasyCart Plugin < 5.4.3 is vulnerable to Local File Inclusion

Software WP EasyCart Type Plugin Vulnerable versions 5.4.3 Fixed in 5.4.3 OWASP Top 10 A1: Injection Classification Local File Inclusion CVE CVE-2023-1124 Patch priority Low CVSS severity Low 7.2 Developer Claim ownership PSID e0487c7e1bcd Credits Shreya Pohekar Required privilege Administrator...

WP EasyCart Plugin for WordPress < 3.0.9 Unrestricted File Upload

The WordPress WP EasyCart Plugin installed on the remote host is affected by an Unrestricted File Upload. Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number. No source data...