WooCommerce Google Sheet Connector <= 1.3.5 - Access Code Update via CSRF

2023-06-2600:00:00

wpvulndb

woocommerce

google sheet

connector

csrf

vulnerability

admin

exploit

update

0.001 Low

EPSS

Percentile

41.1%

JSON

The plugin does not have CSRF check when updating its Access Code, which could allow attackers to make logged in admin change the access code to an arbitrary one via a CSRF attack

Make a logged in admin open https://example.com/wp-admin/admin.php?page=wc-gsheetconnector-config&code=attacker-code

0.001 Low

EPSS

Percentile

41.1%

JSON

Related for WPEX-ID:6E58F099-E8D6-49E4-9F02-D6A556C5B1D2