WordPress CVEs

Description

plugin-fw/lib/yit-plugin-panel-wc.php in the YIT Plugin Framework through 3.3.8 for WordPress allows authenticated options changes.

Affected products and versions

• n/a n/a — Versions not specified
• yithemes yith_woocommerce_wishlist — Up to and including 2.2.13
• yithemes yith_woocommerce_compare — Up to and including 2.3.13
• yithemes yith_woocommerce_quick_view — Up to and including 1.3.13
• yithemes yith_woocommerce_zoom_magnifier — Up to and including 1.3.11
• yithemes yith_woocommerce_ajax_search — Up to and including 1.6.9
• yithemes yith_woocommerce_badge_management — Up to and including 1.3.19
• yithemes yith_woocommerce_brands_add-on — Up to and including 1.3.6
• yithemes yith_woocommerce_request_a_quote — Up to and including 1.4.7
• yithemes yith_woocommerce_social_login — Up to and including 1.3.4
• yithemes yith_woocommerce_order_tracking — Up to and including 1.2.10
• yithemes yith_woocommerce_pdf_invoice_and_shipping_list — Up to and including 1.2.12
• yithemes yith_pre-order_for_woocommerce — Up to and including 1.1.9
• yithemes yith_woocommerce_advanced_reviews — Up to and including 1.3.9
• yithemes yith_woocommerce_product_add-ons — Up to and including 1.5.21
• yithemes yith_woocommerce_gift_cards — Up to and including 1.3.7
• yithemes yith_woocommerce_subscription — Up to and including 1.3.4
• yithemes yith_woocommerce_affiliates — Up to and including 1.6.3
• yithemes yith_woocommerce_cart_messages — Up to and including 1.4.3
• yithemes yith_woocommerce_product_bundles — Up to and including 1.1.15
• yithemes yith_woocommerce_frequently_bought_together — Up to and including 1.2.10
• yithemes yith_woocommerce_multi-step_checkout — Up to and including 1.7.4
• yithemes yith_color_and_label_variations_for_woocommerce — Up to and including 1.8.11
• yithemes yith_custom_thank_you_page_for_woocommerce — Up to and including 1.1.6
• yithemes yith_product_size_charts_for_woocommerce — Up to and including 1.1.1
• yithemes yith_woocommerce_added_to_cart_popup — Up to and including 1.3.11
• yithemes yith_woocommerce_bulk_product_editing — Up to and including 1.2.13
• yithemes yith_woocommerce_stripe — Up to and including 2.0.1
• yithemes yith_woocommerce_waiting_list — Up to and including 1.3.9
• yithemes yith_woocommerce_points_and_rewards — Up to and including 1.3.4
• yithemes yith_advanced_refund_system_for_woocommerce — Up to and including 1.0.10
• yithemes yith_woocommerce_authorize.net_payment_gateway — Up to and including 1.1.12
• yithemes yith_woocommerce_best_sellers — Up to and including 1.1.11
• yithemes yith_woocommerce_mailchimp — Up to and including 2.1.3
• yithemes yith_woocommerce_multi_vendor — Up to and including 3.4.0
• yithemes yith_woocommerce_questions_and_answers — Up to and including 1.1.9
• yithemes yith_woocommerce_recover_abandoned_cart — Up to and including 1.3.2
• yithemes yith_paypal_express_checkout_for_woocommerce — Up to and including 1.2.5
• yithemes yith_desktop_notifications_for_woocommerce — Up to and including 1.2.7

References

• blog.nintechnet.com https://blog.nintechnet.com/authenticated-settings-change-vulnerability-in-yit-plugin-framework/ Third Party Advisory
• wpvulndb.com https://wpvulndb.com/vulnerabilities/9932 Third Party Advisory
• nvd.nist.gov Official NVD record