Vulnerability · Published Jan 9, 2023 · Assigned by WPScan
CVE-2022-4426Mautic Integration For WooCommerce < 1.0.3 - Arbitrary Options Update via CSRF
Medium 4.3
In plain English
A medium-severity security flaw in Mautic Integration for WooCommerce from Unknown. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 24% of all known vulnerabilities).
Severity (CVSS 3.1)4.3Medium
Exploit odds (30 days)0.3%top 75.9% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known
Official description
The Mautic Integration for WooCommerce WordPress plugin before 1.0.3 does not have proper CSRF check when updating settings, and does not ensure that the options to be updated belong to the plugin, allowing attackers to make a logged in admin change arbitrary blog options via a CSRF attack.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Unknown | Mautic Integration for WooCommerce | 0 – before 1.0.3 |
References
- https://wpscan.com/vulnerability/7d3d6b9c-d1c1-4e23-b891-7c72e4e89c38 exploit, vdb-entry, technical-description