CVE-2018-11633

An issue was discovered in the MULTIDOTS Woo Checkout for Digital Goods plugin 2.1 for WordPress. If an admin user can be tricked into visiting a crafted URL created by an attacker (via spear phishing/social engineering), the attacker can change the plugin settings. The function woo_checkout_settings_page in the file class-woo-checkout-for-digital-goods-admin.php doesn't do any check against wp-admin/admin-post.php Cross-site request forgery (CSRF) and user capabilities.
Configurations

Configuration 1 (hide)

cpe:2.3:a:multidots:woo_checkout_for_digital_goods:2.1:*:*:*:*:wordpress:*:*

History

No history.

Information

Published : 2018-05-31 20:29

Updated : 2024-02-28 16:25


NVD link : CVE-2018-11633

Mitre link : CVE-2018-11633

CVE.ORG link : CVE-2018-11633


JSON object : View

Products Affected

multidots

  • woo_checkout_for_digital_goods
CWE
CWE-352

Cross-Site Request Forgery (CSRF)