Cross-Site Request Forgery in eCommerce Product Catalog Plugin for WordPress
CVE-2021-4393
4.3MEDIUM
Key Information:
- Vendor
Wordpress
- Vendor
- CVE Published:
- 1 July 2023
What is CVE-2021-4393?
The eCommerce Product Catalog Plugin for WordPress is susceptible to Cross-Site Request Forgery (CSRF) due to inadequate nonce validation within the save() function. This vulnerability allows attackers to execute unauthorized actions, such as saving orders, by tricking an unsuspecting site administrator into clicking a malicious link. Proper nonce validation is essential to ensure that requests originate from legitimate users, and the absence of this check exposes the plugin and its users to potential exploitation.
Affected Version(s)
eCommerce Product Catalog Plugin for WordPress * < 3.0.18