Vulnerability · Published Jan 16, 2024 · Assigned by WPScan
CVE-2022-1563WPGraphQL WooCommerce <= 0.11.0 - Unauthenticated Coupon Codes Disclosure
Medium 5.3
In plain English
A medium-severity security flaw in wp-graphql-woocommerce from Unknown. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.7% (higher than 54% of all known vulnerabilities).
Severity (CVSS 3.1)5.3Medium
Exploit odds (30 days)0.7%top 45.8% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known
Official description
The WPGraphQL WooCommerce WordPress plugin before 0.12.4 does not prevent unauthenticated attackers from enumerating a shop's coupon codes and values via GraphQL.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Unknown | wp-graphql-woocommerce | 0 – before 0.12.4 |
References
- https://wpscan.com/vulnerability/19138092-50d3-4d63-97c5-aa8e1ce39456/ exploit, vdb-entry, technical-description
- https://github.com/wp-graphql/wp-graphql-woocommerce/