Cross-Site Request Forgery Vulnerability in eCommerce Product Catalog Plugin for WordPress

CVE-2021-4392

Summary

The eCommerce Product Catalog Plugin for WordPress is susceptible to Cross-Site Request Forgery (CSRF) attacks due to insufficient nonce validation in the implecode_save_products_meta() function. As a result, an unauthenticated attacker may exploit this vulnerability to save metadata for products by tricking a site administrator into clicking a malicious link, thereby executing unauthorized actions on the website. This highlights the importance of implementing robust security measures to prevent such vulnerabilities and protect web applications from potential exploitation.

References