Lucene search
WpvulndbWPVDB-ID:987FE51C-2095-4200-BD22-B52B4FD4683AHistoryApr 05, 2023 - 12:00 a.m.
WCFM Marketplace < 3.4.12 - Subscriber+ Unauthorised AJAX Calls
2023-04-0500:00:00
wpscan.com
16
wcfm marketplace
unauthorised ajax calls
subscriber
modify data
privilege escalation
0.001 Low
EPSS
Percentile
38.3%
The plugin does not have authorisation in various AJAX actions, allowing any authenticated users, such as subscriber to call them and modify shipping method details/products, delete arbitrary posts, as well as lead to privilege escalation.
| CPE | Name | Operator | Version |
|---|---|---|---|
| wc-multivendor-marketplace | lt | 3.4.12 |
Related
prion
prion
Design/Logic Flaw
2023-04-05 18:15:00
nvd
nvd
CVE-2022-4935
2023-04-05 18:15:07
cve
cve
CVE-2022-4935
2023-04-05 18:15:07
cvelist
cvelist
CVE-2022-4935
2023-04-05 17:27:39
wordfence
wordfence