CVE Vulnerability

CVE-2022-3154

The Woo Billingo Plus WordPress plugin before 4.4.5.4, Integration for Billingo & Gravity Forms WordPress plugin before 1.0.4, Integration for Szamlazz.hu & Gravity Forms WordPress plugin before 1.2.7 are lacking CSRF checks in various AJAX actions, which could allow attackers to make logged in Shop Managers and above perform unwanted actions, such as deactivate the plugin's license

7.1 /10

CVSS v3.0 : HIGH

V3 Legend

Vector :

Exploitability : 2.8 / Impact : 4.2

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact NONE

Integrity Impact HIGH

Availability Impact LOW

Scope UNCHANGED

References
Link Resource
https://wpscan.com/vulnerability/cda978b2-b31f-495d-8601-0aaa3e4b45cd Exploit Third Party Advisory
Configurations

Configuration 1

cpe:2.3:a:woo_billingo_plus_project:woo_billingo_plus:*:*:*:*:*:wordpress:*:*
cpe:2.3:a:integration_for_billingo_&_gravity_forms_project:integration_for_billingo_&_gravity_forms:*:*:*:*:*:wordpress:*:*
cpe:2.3:a:integration_for_szamlazz.hu_&_gravity_forms_project:integration_for_szamlazz.hu_&_gravity_forms:*:*:*:*:*:wordpress:*:*
Information

Published : 2022-10-10 09:15

Updated : 2022-10-13 03:19

NVD link : CVE-2022-3154

Mitre link : CVE-2022-3154

Products Affected
No products.
CWE
CWE-352