Sender CSRF Vulnerability Affects Newsletter, SMS and Email Marketing Automation for WooCommerce
CVE-2024-39657

8.8HIGH

Key Information:

Vendor
WordPress
Status
Sender – Newsletter, Sms And Email Marketing Automation For WooCommerce
Vendor
CVE Published:
26 August 2024

Summary

A vulnerability exists in Sender - Newsletter, SMS and Email Marketing Automation for WooCommerce, allowing for Cross-Site Request Forgery (CSRF) attacks. This can potentially enable an attacker to perform unauthorized actions on behalf of authenticated users without their consent. This issue primarily affects versions ranging from n/a up to and including 2.6.18, putting users at risk of compromised security if not addressed promptly.

Affected Version(s)

Sender – Newsletter, SMS and Email Marketing Automation for WooCommerce <= 2.6.18

References

https://patchstack.com/database/vulnerability/sender-net-...
vdb-entry

CVSS V3.1

Score:
8.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

Credit

Joshua Chan (Patchstack Alliance)
.