Lucene search

K
wpvulndbWpvulndbWPVDB-ID:7AB15530-8321-487D-97A5-1469B51FCC3F
HistoryOct 31, 2022 - 12:00 a.m.

Booster for WooCommerce - Checkout Files Deletion via CSRF

2022-10-3100:00:00
wpscan.com
4
woocommerce
csrf attack
checkout files deletion

EPSS

0.001

Percentile

37.9%

The plugins do not have CSRF check in place when deleting files uploaded at the checkout, allowing attackers to make a logged in shop manager or admin delete them via a CSRF attack

PoC

Requirements: - Enable the “Checkout File Upload” module of the plugin (/wp-admin/admin.php?page=wc-settings&tab;=jetpack&wcj-cat;=dashboard&section;=all_module) To delete the checkout files from the Order ID 1, Make a logged in shop manager or admin open: https://example.com/wp-admin/?wcj_download_checkout_file_admin_delete_all=1

EPSS

0.001

Percentile

37.9%

Related for WPVDB-ID:7AB15530-8321-487D-97A5-1469B51FCC3F