CVE-2022-1020
Assigner: WPScan
Published: 2022-04-18T17:10:44
State: PUBLISHED
affected: product: Product Table for WooCommerce (wooproducttable)
vendor: Unknown
versions: lessThan: 3.0.2*
status: affected
version: 3.0.2
versionType: custom
lessThan: 3.1.2
status: affected
version: 3.1.2
versionType: custom
credits: value: Mark Costlow
descriptions: value: The Product Table for WooCommerce (wooproducttable) WordPress plugin before 3.1.2 does not have authorisation and CSRF checks in the wpt_admin_update_notice_option AJAX action (available to both unauthenticated and authenticated users), as well as does not validate the callback parameter, allowing unauthenticated attackers to call arbitrary functions with either none or one user controlled argument
problemTypes: descriptions: cweId: CWE-862
description: CWE-862 Missing Authorization
type: CWE
descriptions: cweId: CWE-352
description: CWE-352 Cross-Site Request Forgery (CSRF)
type: CWE
source: discovery: EXTERNAL
title: Woo Product Table < 3.1.2 - Unauthenticated Arbitrary Function Call
x_generator: WPScan CVE Generator