CVEvulnerability

CVE-2022-3154

7.1 HIGH Published 2022-10-10 Modified 2026-06-17 Official page ↗
Status
Modified
Published
2022-10-10
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.1 ([email protected])
7.1 HIGH — CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:L
Weaknesses
CWE-352

Description

The Woo Billingo Plus WordPress plugin before 4.4.5.4, Integration for Billingo & Gravity Forms WordPress plugin before 1.0.4, Integration for Szamlazz.hu & Gravity Forms WordPress plugin before 1.2.7 are lacking CSRF checks in various AJAX actions, which could allow attackers to make logged in Shop Managers and above perform unwanted actions, such as deactivate the plugin's license

Affected configurations

• woo billingo plus project woo billingo plus (< 4.4.5.4) • integration for billingo \& gravity forms project integration for billingo \& gravity forms (< 1.0.4) • integration for szamlazz.hu \& gravity forms project integration for szamlazz.hu \& gravity forms (< 1.2.7)

Related

Weakness · CWE (1)

  • CWE-352 Cross-Site Request Forgery weakness

References