CVE-2022-2657
Assigner: WPScan
Published: 2022-09-05T12:35:22
State: PUBLISHED
affected: product: Multivendor Marketplace Solution for WooCommerce – WC Marketplace
vendor: Unknown
versions: lessThan: 3.8.12
status: affected
version: 3.8.12
versionType: custom
credits: value: ptsfence
descriptions: value: The Multivendor Marketplace Solution for WooCommerce WordPress plugin before 3.8.12 is lacking authorisation and CSRF in multiple AJAX actions, which could allow any authenticated users, such as subscriber to call them and suspend vendors (reporter by the submitter) or update arbitrary order status (identified by WPScan when verifying the issue) for example. Other unauthenticated attacks are also possible, either directly or via CSRF
problemTypes: descriptions: cweId: CWE-862
description: CWE-862 Missing Authorization
type: CWE
descriptions: cweId: CWE-352
description: CWE-352 Cross-Site Request Forgery (CSRF)
type: CWE
source: discovery: EXTERNAL
title: Multivendor Marketplace Solution for WooCommerce < 3.8.12 - Unauthorised AJAX Calls
x_generator: WPScan CVE Generator