CVEvulnerability

CVE-2022-2657

4.3 MEDIUM Published 2022-09-05 Modified 2026-06-17 Official page ↗
Status
Modified
Published
2022-09-05
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.1 ([email protected])
4.3 MEDIUM — CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Weaknesses
CWE-352, CWE-862

Description

The Multivendor Marketplace Solution for WooCommerce WordPress plugin before 3.8.12 is lacking authorisation and CSRF in multiple AJAX actions, which could allow any authenticated users, such as subscriber to call them and suspend vendors (reporter by the submitter) or update arbitrary order status (identified by WPScan when verifying the issue) for example. Other unauthenticated attacks are also possible, either directly or via CSRF

Affected configurations

• wc-marketplace multivendor marketplace solution for woocommerce - wc marketplace (< 3.8.12)

Related

Weakness · CWE (2)

  • CWE-352 Cross-Site Request Forgery weakness
  • CWE-862 Missing Authorization weakness

References