WordPress CVEs

Description

The Checkout Fields Manager WordPress plugin before 1.0.2, Abandoned Cart Recovery WordPress plugin before 1.2.5, Custom Fields for WooCommerce WordPress plugin before 1.0.4, Custom Order Number WordPress plugin through 1.0.1, Custom Registration Forms Builder WordPress plugin before 1.0.2, Advanced Free Gifts WordPress plugin before 1.0.2, Gift Registry for WooCommerce WordPress plugin through 1.0.1, Image Watermark for WooCommerce WordPress plugin before 1.0.1, Order Approval for WooCommerce WordPress plugin before 1.1.0, Order Tracking for WooCommerce WordPress plugin before 1.0.2, Price Calculator for WooCommerce WordPress plugin through 1.0.3, Product Dynamic Pricing and Discounts WordPress plugin through 1.0.6, Product Labels and Stickers WordPress plugin through 1.0.1 have flawed CSRF checks in various places, which could allow attackers to make logged in users perform unwanted actions

Affected WordPress components

• Order Approval for Woocommerce Plugin · order-approval-woocommerce
  Possible match Active
  Before 1.1.0
  View on WordPress.org
• Order Tracking for WooCommerce Plugin · order-tracking-for-woocommerce
  Possible match Abandoned
  Before 1.0.2
  View on WordPress.org

A confirmed match is backed by the plugin or theme slug. A possible match is based on the product name only and should be verified.

Affected products and versions

• Unknown Checkout Fields Manager — Before 1.0.2
• Unknown Abandoned Cart Recovery — Before 1.2.5
• Unknown Custom Fields for WooCommerce — Before 1.0.4
• Unknown Custom Order Number — Up to and including 1.0.1
• Unknown Custom Registration Forms Builder — Before 1.0.2
• Unknown Advanced Free Gifts — Before 1.0.2
• Unknown Gift Registry for WooCommerce — Up to and including 1.0.1
• Unknown Image Watermark for WooCommerce — Before 1.0.1
• Unknown Order Approval for WooCommerce — Before 1.1.0
• Unknown Order Tracking for WooCommerce — Before 1.0.2
• Unknown Price Calculator for WooCommerce — Up to and including 1.0.3
• Unknown Product Dynamic Pricing and Discounts — Up to and including 1.0.6
• Unknown Product Labels and Stickers — Up to and including 1.0.1
• addify checkout_fields_manager — Before 1.0.2
• addify abandoned_cart_recovery — Before 1.2.5
• addify custom_fields_for_woocommerce — Before 1.0.4
• addify custom_order_number — Up to and including 1.0.1
• addify custom_registration_forms_builder — Before 1.0.2
• addify advanced_free_gifts — Before 1.0.2
• addify gift_registry_for_woocommerce — Before 1.0.1
• addify image_watermark_for_woocommerce — Before 1.0.1
• addify order_approval_for_woocommerce — Before 1.1.0
• addify order_tracking_for_woocommerce — Before 1.0.2
• addify price_calculator_for_woocommerce — Before 1.0.3
• addify product_dynamic_pricing_and_discounts — Before 1.0.6
• addify product_labels_and_stickers — Before 1.0.1
• addify gift_registry_for_woocommerce — Up to and including 1.0.1
• addify image_watermark_for_woocommerce — Up to and including 1.0.1

References

• wpscan.com https://wpscan.com/vulnerability/2c2379d0-e373-4587-a747-429d7ee8f6cc Exploit, Third Party Advisory
• nvd.nist.gov Official NVD record