PT-2022-20811 · WordPress · Woo Billingo Plus+2

Lana Codes · Published 2022-10-10 · Updated 2022-10-13 · CVE-2022-3154

Positive Technologies (AI Summary)

CVSS v3.1

7.1

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:L

Name of the Vulnerable Software and Affected Versions Woo Billingo Plus WordPress plugin versions prior to 4.4.5.4 Integration for Billingo & Gravity Forms WordPress plugin versions prior to 1.0.4 Integration for Szamlazz.hu & Gravity Forms WordPress plugin versions prior to 1.2.7

Description The issue is related to a lack of CSRF checks in various AJAX actions, which could allow attackers to make logged-in users with Shop Manager and above permissions perform unwanted actions, such as deactivating the plugin's license.

Recommendations For Woo Billingo Plus WordPress plugin versions prior to 4.4.5.4, update to version 4.4.5.4 or later. For Integration for Billingo & Gravity Forms WordPress plugin versions prior to 1.0.4, update to version 1.0.4 or later. For Integration for Szamlazz.hu & Gravity Forms WordPress plugin versions prior to 1.2.7, update to version 1.2.7 or later.

Exploit

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2022-3154

Affected Products

Integration For Billingo & Gravity Forms

Integration For Szamlazz.Hu & Gravity Forms

Woo Billingo Plus

References · 3

• 🔥 https://wpscan.com/vulnerability/cda978b2-b31f-495d-8601-0aaa3e4b45cd · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2022-3154 · Security Note
• https://osv.dev/vulnerability/CVE-2022-3154 · Vendor Advisory