PT-2023-15924 · WordPress · Wcfm Frontend Manager

Chloe Chamberland · Published 2023-04-05 · Updated 2023-04-11 · CVE-2022-4938

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions WCFM Frontend Manager plugin for WordPress versions up to, and including, 6.6.0

Description The issue allows unauthenticated attackers to perform various actions, such as modifying knowledge bases, notices, payments, managing vendors, and capabilities, by tricking a site's administrator into performing an action like clicking on a link. This is possible due to missing nonce checks on various AJAX actions, affecting hundreds of endpoints.

Recommendations For versions up to, and including, 6.6.0, update to a version that includes nonce checks on AJAX actions to prevent Cross-Site Request Forgery. As a temporary workaround, consider restricting access to AJAX endpoints until a patch is available. Avoid using the WCFM Frontend Manager plugin for WordPress until the issue is resolved.

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2022-4938

Affected Products

Wcfm Frontend Manager

References · 5

• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2632630%40wc-frontend-manager&new=2632630%40wc-frontend-manager&sfp_email=&sfph_mail= · Patch
• https://wordfence.com/threat-intel/vulnerabilities/id/798b57ad-0922-435c-8b4d-8a96b388b314?source=cve · Patch
• https://osv.dev/vulnerability/CVE-2022-4938 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-4938 · Security Note
• https://t.me/cvenotify/48027 · Telegram Post