blogsafe.org My Downloads

BlogSafe.org

WordPress CVEs

Search and review WordPress-related vulnerability records.

← Back to CVE list

CVE-2022-3154

HIGH 7.1 CVSS 3.1
Published
October 10, 2022
Last modified
June 17, 2026
NVD status
Modified
Reported by
contact@wpscan.com
Weakness
CWE-352
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:L

Description

The Woo Billingo Plus WordPress plugin before 4.4.5.4, Integration for Billingo & Gravity Forms WordPress plugin before 1.0.4, Integration for Szamlazz.hu & Gravity Forms WordPress plugin before 1.2.7 are lacking CSRF checks in various AJAX actions, which could allow attackers to make logged in Shop Managers and above perform unwanted actions, such as deactivate the plugin's license

Affected products and versions

  • TODO Woo Billingo Plus — From 4.4.5.4 (including) to 4.4.5.4 (excluding)
  • TODO Integration for Billingo & Gravity Forms — From 1.0.4 (including) to 1.0.4 (excluding)
  • TODO Integration for Szamlazz.hu & Gravity Forms — From 1.2.7 (including) to 1.2.7 (excluding)
  • woo_billingo_plus_project woo_billingo_plus — Before 4.4.5.4
  • integration_for_billingo_\&_gravity_forms_project integration_for_billingo_\&_gravity_forms — Before 1.0.4
  • integration_for_szamlazz.hu_\&_gravity_forms_project integration_for_szamlazz.hu_\&_gravity_forms — Before 1.2.7

References

  • wpscan.com https://wpscan.com/vulnerability/cda978b2-b31f-495d-8601-0aaa3e4b45cd Exploit, Third Party Advisory
  • nvd.nist.gov Official NVD record