CVE-2024-2262 WooCommerce Product Filter < 1.4.4 - Filter Deletion via CSRF

2024-04-0105:00:01

WPScan

github.com

themify wordpress plugin

csrf

bulk action

filter deletion

AI Score

6.9

Confidence

High

SSVC

Exploitation

poc

Automatable

Technical Impact

partial

JSON

Themify WordPress plugin before 1.4.4 does not have CSRF check in its bulk action, which could allow attackers to make logged in users delete arbitrary filters via CSRF attack, granted they know the related filter slugs

ADP Affected

[
  {
    "cpes": [
      "cpe:2.3:a:themify:woocommerce_product_filter:*:*:*:*:*:*:*:*"
    ],
    "vendor": "themify",
    "product": "woocommerce_product_filter",
    "versions": [
      {
        "status": "affected",
        "version": "0",
        "lessThan": "1.4.4",
        "versionType": "semver"
      }
    ],
    "defaultStatus": "unknown"
  }
]