Cross-Site Request Forgery Vulnerability in WCFM Marketplace Plugin for WordPress
CVE-2022-4936

6.3MEDIUM

Key Information:

Vendor
Wordpress
Status
Wcfm Marketplace – Best Multivendor Marketplace For WooCommerce
Vendor
CVE Published:
5 April 2023

Summary

The WCFM Marketplace plugin for WordPress exposes users to a Cross-Site Request Forgery vulnerability due to inadequate nonce checks on various AJAX actions. This flaw permits unauthenticated attackers to exploit the system by sending forged requests. By tricking an administrator into executing certain actions, attackers can manipulate shipping methods, alter product details, delete posts, and potentially execute other harmful actions, posing significant risks to site integrity and security.

Affected Version(s)

WCFM Marketplace – Best Multivendor Marketplace for WooCommerce * <= 3.4.12

References

https://www.wordfence.com/threat-intel/vulnerabilities/id...
https://plugins.trac.wordpress.org/changeset?sfp_email=&s...

CVSS V3.1

Score:
6.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Chloe Chamberland
.