Description

WordPress Plugin WooCommerce is prone to multiple vulnerabilities, including directory traversal and security bypass vulnerabilities. Exploiting these issues could allow an attacker to obtain sensitive information that could aid in further attacks, or to perform otherwise restricted actions and subsequently delete arbitrary comment. WordPress Plugin WooCommerce version 6.2.0 is vulnerable; prior versions may also be affected.

Remediation

Update to plugin version 6.2.1 or latest

References

https://sploitus.com/exploit?id=WPEX-ID:B76DBF37-A0A2-48CF-BD85-3EBBC2F394DD

https://developer.woocommerce.com/2022/02/22/woocommerce-6-2-1-security-fix/

Related Vulnerabilities

MySQL Exposure of Sensitive Information to an Unauthorized Actor Vulnerability (CVE-2017-10268)

Joomla Improper Input Validation Vulnerability (CVE-2018-12712)

PHP Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability (CVE-2013-2110)

WordPress Plugin AdRoll for WooCommerce Stores Unspecified Vulnerability (2.2.5)

WordPress Plugin Post SMTP-WP SMTP with Email Logs & Mobile App for Failure Alerts-Any SMTP Plus Gmail SMTP, Office 365, Brevo, Mailgun, Amazon SES, Postmark Cross-Site Scripting (2.8.6)

Severity

High

Classification

CVE-2022-0775 CWE-22 CWE-863 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

Tags

Missing Update