DPD Baltic Shipping by DPD

DPD Baltic Shipping by DPD <= 1.2.57 - Subscriber+ Arbitrary Options Deletion

LANACOMMONVDB ID: de2b3f05-7766-482e-84df-715fcd450557

The plugin does not have authorisation and Cross-Site Request Forgery (CSRF) check in an AJAX action, which could allow any authenticated users, such as subscriber to delete arbitrary options from the blog, which could make the blog unavailable.

You must be log in to view vulnerability details.

Or register a new account.

References

Source Code: https://wordpress.org/plugins/woo-shipping-dpd-baltic/

CVE: CVE-2022-3999

Attributes

Catgory: WordPress Plugin

Discovered: 2022-09-07

Published: 2022-11-21

Affected Version: <= 1.2.57

Classification

Type: Cross-Site Request Forgery (CSRF), Missing Authorization

Researcher

Name: István Márton

Email: [email protected]

Support Us?

We would truly appreciate it if you bought us a bunny (food for a snow leopard).