PT-2022-5124 · WordPress · Ultimate Sms Notifications For Woocommerce

Zhouyuan Yang

·

Published

2022-09-06

·

Updated

2022-09-13

·

CVE-2022-2429

CVSS v3.1

8.0

High

VectorAV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
Name of the Vulnerable Software and Affected Versions Ultimate SMS Notifications for WooCommerce plugin for WordPress versions up to, and including, 1.4.1
Description The issue is related to a CSV Injection vulnerability in the 'Export Utility' functionality. This allows authenticated attackers, such as subscribers, to embed untrusted input into billing information, like the First Name, which can result in code execution when the exported CSV file is downloaded and opened on a local system with a vulnerable configuration. The vulnerability can be exploited by a remote attacker to perform cross-site scripting attacks.
Recommendations For versions up to, and including, 1.4.1, consider disabling the 'Export Utility' functionality until a patch is available to prevent exploitation. Restrict access to the billing information to minimize the risk of attackers embedding malicious input. As a temporary workaround, avoid using the 'Export Utility' feature until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

RCE

Weakness Enumeration

CWE-138CWE-1236

Related Identifiers

BDU:2022-06373
CVE-2022-2429

Affected Products

Ultimate Sms Notifications For Woocommerce