PT-2024-11504 · WordPress · Woocommerce

Krzysztof Zając · Published 2024-01-16 · Updated 2024-01-19 · CVE-2022-0775

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions WooCommerce WordPress plugin versions prior to 6.2.1

Description The issue is related to a lack of proper authorization checks when deleting reviews. This could allow any authenticated users, such as subscribers, to delete arbitrary comments.

Recommendations For versions prior to 6.2.1, update to version 6.2.1 or later to resolve the issue.

Exploit

Fix

Incorrect Authorization

Weakness Enumeration

CWE-863

Related Identifiers

CVE-2022-0775

Affected Products

Woocommerce

References · 6

• 🔥 https://wpscan.com/vulnerability/b76dbf37-a0a2-48cf-bd85-3ebbc2f394dd · Exploit
• https://plugins.trac.wordpress.org/changeset/2683324 · Patch
• https://osv.dev/vulnerability/CVE-2022-0775 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-0775 · Security Note
• https://developer.woocommerce.com/2022/02/22/woocommerce-6-2-1-security-fix · Note
• https://twitter.com/CVEnew/status/1747293166800392583 · Twitter Post