PT-2023-25126 · WordPress · Woocommerce Pre-Orders

Erwan Lr · Published 2023-07-31 · Updated 2023-08-03 · CVE-2023-3507

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions WooCommerce Pre-Orders WordPress plugin versions prior to 2.0.3

Description The issue is related to a flawed CSRF check when canceling pre-orders. This could allow attackers to make logged-in admins cancel arbitrary pre-orders via a CSRF attack.

Recommendations For versions prior to 2.0.3, update to version 2.0.3 or later to resolve the issue. As a temporary workaround, consider restricting access to the pre-order cancellation functionality to minimize the risk of exploitation.

Exploit

Fix

Related Identifiers

CVE-2023-3507

Affected Products

Woocommerce Pre-Orders

References · 4

• 🔥 https://wpscan.com/vulnerability/e72bbe9b-e51d-40ab-820d-404e0cb86ee6 · Exploit
• https://osv.dev/vulnerability/CVE-2023-3507 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-3507 · Security Note
• https://t.me/cibsecurity/67445 · Telegram Post