PT-2024-11040 · Woobewoo · Woobewoo Product Filter

David Edgar · Published 2024-10-15 · Updated 2024-10-23 · CVE-2021-4444

Positive Technologies (AI Summary)

CVSS v3.1

7.3

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions Product Filter by WooBeWoo plugin for WordPress versions up to, and including 1.4.9

Description The issue is related to authorization bypass due to missing authorization checks on various functions, allowing unauthenticated attackers to perform unauthorized actions such as creating new filters and injecting malicious javascript into a vulnerable site. This was actively exploited at the time of discovery.

Recommendations Update to the latest version immediately to mitigate risks. As a temporary workaround, consider restricting access to vulnerable functions until a patch is available. Avoid using the plugin until the issue is resolved with an update.

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2021-4444

Affected Products

Woobewoo Product Filter

References · 10

• https://nvd.nist.gov/vuln/detail/CVE-2021-4444 · Security Note
• https://twitter.com/CVEnew/status/1846444836800332142 · Twitter Post
• https://twitter.com/Patrowl_io/status/1849013499130757288 · Twitter Post
• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2527958%40woo-product-filter&new=2527958%40woo-product-filter&sfp_email=&sfph_mail= · Note
• https://twitter.com/cracbot/status/1848242890390348145 · Twitter Post
• https://twitter.com/transilienceai/status/1847688524943781947 · Twitter Post
• https://twitter.com/transilienceai/status/1847688534246711355 · Twitter Post
• https://wordfence.com/threat-intel/vulnerabilities/id/30b6b0bf-e632-4e83-89ee-a424382534da?source=cve · Note
• https://twitter.com/inthewildio/status/1848995727768162422 · Twitter Post
• https://twitter.com/transilienceai/status/1847688516307648589 · Twitter Post