CVE-2022-2382 - Product Slider for WooCommerce < 2.5.7 - Subscriber+ Arbitrary Options Deletion

Back Back to CVE browser

MEDIUM

Product Slider for WooCommerce < 2.5.7 - Subscriber+ Arbitrary Options Deletion

Published Aug 22, 2022

4.3

MEDIUM

CVSS 3.1

EPSS 0.36%

Description

The Product Slider for WooCommerce WordPress plugin before 2.5.7 has flawed CSRF checks and lack authorisation in some of its AJAX actions, allowing any authenticated users, such as subscriber to call them. One in particular could allow them to delete arbitrary blog options.

Affected products

Vendor n/a Product Product Slider for WooCommerce Default
unknown
Affected
- ≥ 2.5.7, < 2.5.7

Default status is the baseline for the product. Each version can override it (patched versions can be marked unaffected).

Vendor	Product	Default status	Versions
n/a	Product Slider for WooCommerce	unknown	Affected ≥ 2.5.7, < 2.5.7

Remediation

No remediation recorded yet.

Weaknesses (2)

CWE-352

CSRF

CWE-862

Missing Authorization

References (2)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-34649
Advisory
https://wpscan.com/vulnerability/777d4637-444b-4eda-bc21-95d3a3bf6cd3
x_refsource_MISCExploitThird Party Advisory

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-34649		Advisory
https://wpscan.com/vulnerability/777d4637-444b-4eda-bc21-95d3a3bf6cd3		x_refsource_MISCExploitThird Party Advisory

Change history (0)

No recorded changes yet.

Sources

CVE.org / MITRE

Status PUBLISHED

Assigner WPScan

Published Aug 22, 2022

Updated Aug 3, 2024

Reserved Jul 11, 2022

Link CVE-2022-2382

CISA Vulnrichment

No data

NVD

Status Modified

Modified Jun 17, 2026

Link CVE-2022-2382

Red Hat

No data

ENISA EUVD

Assigner WPScan

Published Aug 22, 2022

Updated Aug 3, 2024

Link EUVD-2022-34649

GitHub

No data