blogsafe.org My Downloads

BlogSafe.org

WordPress CVEs

Search and review WordPress-related vulnerability records.

← Back to CVE list

CVE-2022-1020

CRITICAL 9.8 CVSS 3.1
Published
April 18, 2022
Last modified
June 17, 2026
NVD status
Modified
Reported by
contact@wpscan.com
Weakness
CWE-352, CWE-862
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Description

The Product Table for WooCommerce (wooproducttable) WordPress plugin before 3.1.2 does not have authorisation and CSRF checks in the wpt_admin_update_notice_option AJAX action (available to both unauthenticated and authenticated users), as well as does not validate the callback parameter, allowing unauthenticated attackers to call arbitrary functions with either none or one user controlled argument

Affected products and versions

  • Unknown Product Table for WooCommerce (wooproducttable) — From 3.0.2 (including) to 3.0.2* (excluding)
  • Unknown Product Table for WooCommerce (wooproducttable) — From 3.1.2 (including) to 3.1.2 (excluding)
  • codeastrology woo_product_table — Before 3.1.2

References

  • wpscan.com https://wpscan.com/vulnerability/04fe89b3-8ad1-482f-a96d-759d1d3a0dd5 Exploit, Third Party Advisory
  • nvd.nist.gov Official NVD record