Description

WordPress Plugin Advanced Dynamic Pricing for WooCommerce is prone to multiple vulnerabilities, including security bypass and cross-site request forgery vulnerabilities. Exploiting these issues could allow an attacker to perform otherwise restricted actions and subsequently export pricing ranges, obtain advanced pricing info, make changes to advanced pricing rules, or to perform certain administrative actions and gain unauthorized access to the affected application. WordPress Plugin Advanced Dynamic Pricing for WooCommerce version 4.1.5 is vulnerable; prior versions may also be affected.

Remediation

Update to plugin version 4.1.6 or latest

References

https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/advanced-dynamic-pricing-for-woocommerce/advanced-dynamic-pricing-for-woocommerce-415-missing-authorization

https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/advanced-dynamic-pricing-for-woocommerce/advanced-dynamic-pricing-for-woocommerce-415-missing-authorization-in-ajaxcalculateseveralproducts-function

https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/advanced-dynamic-pricing-for-woocommerce/advanced-dynamic-pricing-for-woocommerce-415-missing-authorization-in-migratecommontoproductonly-function

https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/advanced-dynamic-pricing-for-woocommerce/advanced-dynamic-pricing-for-woocommerce-415-cross-site-request-forgery-2

https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/advanced-dynamic-pricing-for-woocommerce/advanced-dynamic-pricing-for-woocommerce-415-cross-site-request-forgery

https://plugins.svn.wordpress.org/advanced-dynamic-pricing-for-woocommerce/trunk/readme.txt

Related Vulnerabilities

TinyMCE Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2020-12648)

WordPress 'wp-admin/options.php' Remote Code Execution Vulnerability (0.6.2 - 2.3.2)

WordPress Plugin WordPress Firewall 2 Multiple Vulnerabilities (1.3)

Apache HTTP Server NULL Pointer Dereference Vulnerability (CVE-2009-3094)

WordPress Plugin Walk Score Multiple Cross-Site Scripting Vulnerabilities (0.5.5)

Severity

High

Classification

CVE-2022-40203 CVE-2022-43488 CVE-2022-43491 CWE-352 CWE-862 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Tags

Missing Update