PT-2021-23598 · WordPress · Variation Swatches For Woocommerce

Published 2021-12-14 · Updated 2022-08-09 · CVE-2021-42367

Positive Technologies (AI Summary)

CVSS v3.1

6.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Variation Swatches for WooCommerce WordPress plugin versions up to and including 2.1.1

Description The issue allows attackers to inject arbitrary web scripts via several parameters in the ~/includes/class-menu-page.php file, due to missing authorization checks on the tawcvs save settings function. This enables low-level authenticated users, such as subscribers, to exploit the vulnerability.

Recommendations For versions up to and including 2.1.1, update to a version higher than 2.1.1 to resolve the issue. As a temporary workaround, consider restricting access to the tawcvs save settings function to prevent low-level authenticated users from exploiting the vulnerability.

Fix

Missing Authorization

XSS

Weakness Enumeration

CWE-862

CWE-79

Related Identifiers

CVE-2021-42367

Affected Products

Variation Swatches For Woocommerce

References · 5

• https://osv.dev/vulnerability/CVE-2021-42367 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-42367 · Security Note
• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2634227%40variation-swatches-for-woocommerce&new=2634227%40variation-swatches-for-woocommerce&sfp_email=&sfph_mail= · Patch
• https://t.me/cibsecurity/33941 · Telegram Post
• https://wordfence.com/vulnerability-advisories/#CVE-2021-42367 · Note