PT-2022-22186 · WordPress · Product Stock Manager

Published 2022-11-07 · Updated 2023-07-21 · CVE-2022-3451

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions Product Stock Manager WordPress plugin version 1.0.4 and earlier

Description The issue affects the Product Stock Manager WordPress plugin, where multiple AJAX actions lack proper authorization and CSRF checks. This allows users with a role as low as subscriber to call these actions, potentially enabling them to update arbitrary options.

Recommendations For versions prior to 1.0.5, update to version 1.0.5 or later to resolve the issue. As a temporary workaround, consider restricting access to the AJAX actions until the update is applied.

Exploit

Fix

Missing Authorization

CSRF

Weakness Enumeration

CWE-862

CWE-352

Related Identifiers

CVE-2022-3451

Affected Products

Product Stock Manager

References · 5

• 🔥 https://wpscan.com/vulnerability/d8005cd0-8232-4d43-a4e4-14728eaf1300 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2022-3451 · Security Note
• https://osv.dev/vulnerability/CVE-2022-3451 · Vendor Advisory
• https://t.me/cibsecurity/52585 · Telegram Post
• https://t.me/cvenotify/37408 · Telegram Post