WooCommerce Cart Abandonment Recovery Plugin Vulnerable to CSRF Attacks
CVE-2024-2322

Currently unrated

Key Information:

Vendor
Wordpress
Status
WooCommerce Cart Abandonment Recovery
Vendor
CVE Published:
3 April 2024

Badges

👾 Exploit Exists🟡 Public PoC

Summary

The WooCommerce Cart Abandonment Recovery WordPress plugin before 1.2.27 does not have CSRF check in its bulk actions, which could allow attackers to make logged in admins delete arbitrary email templates as well as delete and unsubscribe users from abandoned orders via CSRF attacks.

Affected Version(s)

WooCommerce Cart Abandonment Recovery 0 < 1.2.27

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2024-2322 - Proof of Concept

References

https://wpscan.com/vulnerability/c740ed3b-d6b8-4afc-8c6b-...
exploitvdb-entrytechnical-description

Timeline

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

  • Vulnerability published

Credit

Erwan LR (WPScan)
WPScan
.