Cross-Site Request Forgery Vulnerability in WCFM Marketplace Plugin for WordPress
CVE-2022-4936

6.3MEDIUM

Key Information:

Vendor: Wordpress
Status: Wcfm Marketplace – Best Multivendor Marketplace For WooCommerce
Vendor: CVE Published:; 5 April 2023

What is CVE-2022-4936?

The WCFM Marketplace plugin for WordPress exposes users to a Cross-Site Request Forgery vulnerability due to inadequate nonce checks on various AJAX actions. This flaw permits unauthenticated attackers to exploit the system by sending forged requests. By tricking an administrator into executing certain actions, attackers can manipulate shipping methods, alter product details, delete posts, and potentially execute other harmful actions, posing significant risks to site integrity and security.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch

Affected Version(s)

WCFM Marketplace – Best Multivendor Marketplace for WooCommerce * <= 3.4.12

References

https://www.wordfence.com/threat-intel/vulnerabilities/id...

https://plugins.trac.wordpress.org/changeset?sfp_email=&s...

CVSS V3.1

Score:

6.3

Severity:

MEDIUM

Confidentiality:

Low

Integrity:

Low

Availability:

Low

Attack Vector:

Network

Attack Complexity:

Low

Privileges Required:

None

User Interaction:

Required

Scope:

Unchanged

Timeline

Vulnerability published
Apr 5, 2023
Vulnerability Reserved
Apr 5, 2023

Credit

Chloe Chamberland

JSON

Wordpress