PT-2024-11631 · Agence Press · Css Adder By Agence-Press

Dave Jong · Published 2024-01-19 · Updated 2024-01-30 · CVE-2022-40700

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Montonio for WooCommerce versions 6.0.1 and earlier Wpopal Core Features versions 1.5.8 and earlier ArcStone wp-amo versions 4.6.6 and earlier WooVirtualWallet – A virtual wallet for WooCommerce versions 2.2.1 and earlier WooVIP – Membership plugin for WordPress and WooCommerce versions 1.4.4 and earlier WooSupply – Suppliers, Supply Orders and Stock Management versions 1.2.2 and earlier Theme Minifier versions 2.0 and earlier Styles versions 1.2.3 and earlier WordPress Page Builder – Qards versions 1.0.5 and earlier PHPFreeChat versions 0.2.8 and earlier Custom Login Admin Front-end CSS versions 1.4.1 and earlier CSS Adder By Agence-Press versions 1.5.0 and earlier Confirm Data versions 1.0.7 and earlier AMP Toolbox versions 2.1.1 and earlier Admin CSS MU versions 2.6 and earlier

Description A Server-Side Request Forgery (SSRF) issue has been identified, affecting multiple plugins. This issue allows an attacker to forge requests to the server, potentially leading to unauthorized access or data exposure. The estimated number of potentially affected devices worldwide is not specified. There is no information available about real-world incidents where this issue was exploited.

Recommendations For Montonio for WooCommerce versions 6.0.1 and earlier, update to a version later than 6.0.1. For Wpopal Core Features versions 1.5.8 and earlier, update to a version later than 1.5.8. For ArcStone wp-amo versions 4.6.6 and earlier, update to a version later than 4.6.6. For WooVirtualWallet – A virtual wallet for WooCommerce versions 2.2.1 and earlier, update to a version later than 2.2.1. For WooVIP – Membership plugin for WordPress and WooCommerce versions 1.4.4 and earlier, update to a version later than 1.4.4. For WooSupply – Suppliers, Supply Orders and Stock Management versions 1.2.2 and earlier, update to a version later than 1.2.2. For Theme Minifier versions 2.0 and earlier, update to a version later than 2.0. For Styles versions 1.2.3 and earlier, update to a version later than 1.2.3. For WordPress Page Builder – Qards versions 1.0.5 and earlier, update to a version later than 1.0.5. For PHPFreeChat versions 0.2.8 and earlier, update to a version later than 0.2.8. For Custom Login Admin Front-end CSS versions 1.4.1 and earlier, update to a version later than 1.4.1. For CSS Adder By Agence-Press versions 1.5.0 and earlier, update to a version later than 1.5.0. For Confirm Data versions 1.0.7 and earlier, update to a version later than 1.0.7. For AMP Toolbox versions 2.1.1 and earlier, update to a version later than 2.1.1. For Admin CSS MU versions 2.6 and earlier, update to a version later than 2.6.

Fix

SSRF

Weakness Enumeration

CWE-918

Related Identifiers

CVE-2022-40700

Affected Products

Css Adder By Agence-Press

References · 19

• https://nvd.nist.gov/vuln/detail/CVE-2022-40700 · Security Note
• https://osv.dev/vulnerability/CVE-2022-40700 · Vendor Advisory
• https://patchstack.com/database/vulnerability/montonio-for-woocommerce/wordpress-montonio-for-woocommerce-plugin-6-0-1-server-side-request-forgery-ssrf?_s_id=cve · Note
• https://patchstack.com/database/vulnerability/phpfreechat/wordpress-phpfreechat-plugin-0-2-8-server-side-request-forgery-ssrf?_s_id=cve · Note
• https://patchstack.com/database/vulnerability/theme-minifier/wordpress-theme-minifier-plugin-2-0-server-side-request-forgery-ssrf?_s_id=cve · Note
• https://patchstack.com/database/vulnerability/admin-css-mu/wordpress-admin-css-mu-plugin-2-6-server-side-request-forgery-ssrf-vulnerability?_s_id=cve · Note
• https://twitter.com/CVEnew/status/1748354996381364317 · Twitter Post
• https://t.me/cvenotify/69271 · Telegram Post
• https://patchstack.com/database/vulnerability/custom-login-admin-front-end-css-with-multisite-support/wordpress-custom-login-admin-front-end-css-plugin-1-4-1-server-side-request-forgery-ssrf?_s_id=cve · Note
• https://patchstack.com/database/vulnerability/css-adder-by-agence-press/wordpress-css-adder-by-agene-press-plugin-1-5-0-server-side-request-forgery-ssrf?_s_id=cve · Note
• https://patchstack.com/database/vulnerability/amp-toolbox/wordpress-amp-toolbox-plugin-2-1-1-server-side-request-forgery-ssrf?_s_id=cve · Note
• https://patchstack.com/database/vulnerability/wp-amo/wordpress-amo-for-wp-plugin-4-6-6-server-side-request-forgery-ssrf?_s_id=cve · Note
• https://patchstack.com/database/vulnerability/styles/wordpress-styles-plugin-1-2-3-server-side-request-forgery-ssrf?_s_id=cve · Note
• https://patchstack.com/database/vulnerability/wpopal-core-features/wordpress-wpopal-core-features-plugin-1-5-7-server-side-request-forgery-ssrf?_s_id=cve · Note
• https://patchstack.com/database/vulnerability/confirm-data/wordpress-confirm-data-plugin-1-0-7-unauth-server-side-request-forgery-ssrf-vulnerability?_s_id=cve · Note