Към съдържанието
Търсене

CVE-2021-4337: XforWooCommerce Package Quantity Discount, заобикаляне

8.8

CVSS 3.1

Няма данни

Вероятност да бъде експлоатирана в следващите 30 дни (EPSS)

Няма потвърждение

Атакува се

Няма данни

Време до експлоатация

Атакува се по мрежата, без особени условия, с обикновен потребителски вход и без действие от потребителя.

CVE радар: още уязвимости от този вид

  • Експлоатация: няма данни за експлоатация
  • Атаката не може да се автоматизира

Описание

Оригинално описание

Sixteen XforWooCommerce Add-On Plugins for WordPress are vulnerable to authorization bypass due to a missing capability check on the wp_ajax_svx_ajax_factory function in various versions listed below. This makes it possible for authenticated attackers, with subscriber-level permissions and above, to read, edit, or delete WordPress settings, plugin settings, and to arbitrarily list all users on a WordPress website. The plugins impacted are: Product Filter for WooCommerce < 8.2.0, Improved Product Options for WooCommerce < 5.3.0, Improved Sale Badges for WooCommerce < 4.4.0, Share, Print and PDF Products for WooCommerce < 2.8.0, Product Loops for WooCommerce < 1.7.0, XforWooCommerce < 1.7.0, Package Quantity Discount < 1.2.0, Price Commander for WooCommerce < 1.3.0, Comment and Review Spam Control for WooCommerce < 1.5.0, Add Product Tabs for WooCommerce < 1.5.0, Autopilot SEO for WooCommerce < 1.6.0, Floating Cart < 1.3.0, Live Search for WooCommerce < 2.1.0, Bulk Add to Cart for WooCommerce < 1.3.0, Live Product Editor for WooCommerce < 4.7.0, and Warranties and Returns for WooCommerce < 5.3.0.

Засегнати продукти

  • XforWooCommerce Package Quantity Discount: преди 1.2.0
  • XforWooCommerce Price Commander for WooCommerce: преди 1.3.0
  • XforWooCommerce Bulk Add to Cart for WooCommerce: преди 1.3.0
  • XforWooCommerce Floating Cart for WooCommerce: преди 1.3.0
  • XforWooCommerce Comment and Review Spam Control for WooCommerce: преди 1.5.0
  • XforWooCommerce Add Product Tabs for WooCommerce: преди 1.5.0
  • XforWooCommerce Autopilot SEO for WooCommerce: преди 1.6.0
  • XforWooCommerce XforWooCommerce: преди 1.7.0
  • XforWooCommerce Product Loops for WooCommerce: преди 1.7.0
  • XforWooCommerce Live Search for WooCommerce: преди 2.1.0
  • XforWooCommerce Share, Print and PDF Products for WooCommerce: преди 2.8.0
  • XforWooCommerce Improved Sale Badges for WooCommerce: преди 4.4.0
  • XforWooCommerce Live Product Editor for WooCommerce: преди 4.7.0
  • XforWooCommerce Warranties and Returns for WooCommerce: преди 5.3.0
  • XforWooCommerce Improved Product Options for WooCommerce: преди 5.3.0
  • XforWooCommerce Product Filter for WooCommerce: преди 8.2.0

Вид слабост

История

  • 7 юни 2023 Публикувано

Други уязвимости в XforWooCommerce Package Quantity Discount

Първоизточници

CVE-2021-4337: XforWooCommerce Package Quantity Discount, заобикаляне | freedomonline.bg