CVE-2018-11633

An issue was discovered in the MULTIDOTS Woo Checkout for Digital Goods plugin 2.1 for WordPress

published May 31, 2018

CVSS
—
EPSS
1%
Percentile
43.6
In the wild
Unconfirmed
What it is

An issue was discovered in the MULTIDOTS Woo Checkout for Digital Goods plugin 2.1 for WordPress. If an admin user can be tricked into visiting a crafted URL created by an attacker (via spear phishing/social engineering), the attacker can change the plugin settings. The function woo_checkout_settings_page in the file class-woo-checkout-for-digital-goods-admin.php doesn't do any check against wp-admin/admin-post.php Cross-site request forgery (CSRF) and user capabilities.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.00529 · 43.6th percentile
Published
2018-05-31T20:00Z
EPSS history
Timeline
  • 31 MAY 20:00Z
    An issue was discovered in the MULTIDOTS Woo Checkout for Digital Goods plugin 2.1 for WordPress
    cvelistv5