CVE-2018-11633

An issue was discovered in the MULTIDOTS Woo Checkout for Digital Goods plugin 2.1 for WordPress. If an admin user can be tricked into visiting a crafted URL created by an attacker (via spear phishing/social engineering), the attacker can change the plugin settings. The function woo_checkout_settings_page in the file class-woo-checkout-for-digital-goods-admin.php doesn't do any check against wp-admin/admin-post.php Cross-site request forgery (CSRF) and user capabilities.
Configurations

Configuration 1 (hide)

cpe:2.3:a:multidots:woo_checkout_for_digital_goods:2.1:*:*:*:*:wordpress:*:*

History

21 Nov 2024, 03:43

Type Values Removed Values Added
References () http://labs.threatpress.com/cross-site-request-forgery-csrf-in-woo-checkout-for-digital-goods-plugin/ - Exploit, Third Party Advisory () http://labs.threatpress.com/cross-site-request-forgery-csrf-in-woo-checkout-for-digital-goods-plugin/ - Exploit, Third Party Advisory
References () https://wordpress.org/plugins/woo-checkout-for-digital-goods/#developers - Release Notes () https://wordpress.org/plugins/woo-checkout-for-digital-goods/#developers - Release Notes

Information

Published : 2018-05-31 20:29

Updated : 2024-11-21 03:43


NVD link : CVE-2018-11633

Mitre link : CVE-2018-11633

CVE.ORG link : CVE-2018-11633


JSON object : View

Products Affected

multidots

  • woo_checkout_for_digital_goods
CWE
CWE-352

Cross-Site Request Forgery (CSRF)