First Order Discount Woocommerce < 1.22 - Discount Update via CSRF

2023-12-1000:00:00

wpscan.com

woocommerce

plugin

csrf

attack

discounts

8.6 High

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

24.3%

JSON

Description The plugin does not have CSRF check in its fodw_save_discount() function, which could allow attackers to make logged in admins update discounts via a CSRF attack

CPENameOperatorVersion
eq1.22

CPE	Name	Operator	Version
		eq	1.22

References

patchstack.com/database/vulnerability/first-order-discount-woocommerce/wordpress-first-order-discount-woocommerce-plugin-1-21-cross-site-request-forgery-csrf-vulnerability