Cross-Site Request Forgery Vulnerability in ShipWorks Connector for WooCommerce by WordPress

CVE-2024-13317

What is CVE-2024-13317?

The ShipWorks Connector for WooCommerce plugin for WordPress has a vulnerability that allows unauthenticated attackers to exploit missing or incorrect nonce validation on the 'shipworks-wordpress' page. By tricking a site administrator into performing an action, such as clicking a malicious link, an attacker can update the service's username and password without authorization. This highlights the importance of implementing proper nonce validation to safeguard against CSRF attacks.

References