Cross-Site Request Forgery Vulnerability in Abandoned Cart Recovery for WooCommerce Plugin by WordPress
CVE-2021-4395
4.3MEDIUM
Key Information:
- Vendor
Wordpress
- Vendor
- CVE Published:
- 1 July 2023
What is CVE-2021-4395?
The Abandoned Cart Recovery for WooCommerce plugin for WordPress is susceptible to Cross-Site Request Forgery (CSRF) in versions up to 1.0.4. This vulnerability stems from inadequate nonce validation in crucial functions, namely get_items() and extra_tablenav(). As a result, unauthenticated attackers may exploit this weakness to execute read-only actions by deceiving a site administrator into clicking a specially crafted link. Organizations using this plugin should prioritize upgrading to the patched version to mitigate potential risks.
Affected Version(s)
Abandoned Cart Recovery for WooCommerce * <= 1.0.4