Cross-Site Request Forgery Vulnerability in WCFM Marketplace Plugin for WordPress
CVE-2022-4936
6.3MEDIUM
Key Information:
- Vendor
Wordpress
- Vendor
- CVE Published:
- 5 April 2023
What is CVE-2022-4936?
The WCFM Marketplace plugin for WordPress exposes users to a Cross-Site Request Forgery vulnerability due to inadequate nonce checks on various AJAX actions. This flaw permits unauthenticated attackers to exploit the system by sending forged requests. By tricking an administrator into executing certain actions, attackers can manipulate shipping methods, alter product details, delete posts, and potentially execute other harmful actions, posing significant risks to site integrity and security.
Affected Version(s)
WCFM Marketplace – Best Multivendor Marketplace for WooCommerce * <= 3.4.12