An issue was discovered in the MULTIDOTS Woo Checkout for Digital Goods plugin 2.1 for WordPress. If an admin user can be tricked into visiting a crafted URL created by an attacker (via spear phishing/social engineering), the attacker can change the plugin settings. The function woo_checkout_settings_page in the file class-woo-checkout-for-digital-goods-admin.php doesn't do any check against wp-admin/admin-post.php Cross-site request forgery (CSRF) and user capabilities.
References
Link | Resource |
---|---|
http://labs.threatpress.com/cross-site-request-forgery-csrf-in-woo-checkout-for-digital-goods-plugin/ | Exploit Third Party Advisory |
https://wordpress.org/plugins/woo-checkout-for-digital-goods/#developers | Release Notes |
Configurations
History
No history.
Information
Published : 2018-05-31 20:29
Updated : 2024-02-28 16:25
NVD link : CVE-2018-11633
Mitre link : CVE-2018-11633
CVE.ORG link : CVE-2018-11633
JSON object : View
Products Affected
multidots
- woo_checkout_for_digital_goods
CWE
CWE-352
Cross-Site Request Forgery (CSRF)