WordPress WooCommerce Product Add-ons Plugin <= 6.1.3 is vulnerable to Cross Site Request Forgery (CSRF)
CVE-2023-32794

8.8HIGH

Key Information:

Vendor

WordPress
Status
Product Add-ons
Vendor
CVE Published:
9 November 2023

What is CVE-2023-32794?

A Cross-Site Request Forgery (CSRF) vulnerability exists in the WooCommerce Product Add-Ons plugin for WordPress, affecting versions 6.1.3 and earlier. This flaw could allow attackers to exploit users' sessions, leading to unauthorized actions being executed on behalf of unsuspecting users. It's crucial for website administrators using this plugin to apply the latest security updates to mitigate potential risks and ensure user data integrity.

Affected Version(s)

Product Add-Ons <= 6.1.3

References

https://patchstack.com/database/vulnerability/woocommerce...
vdb-entry

CVSS V3.1

Score:
8.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Rafie Muhammad (Patchstack)
.