CVE-2022-0215CWE-352

XootiX Plugins <= Various Versions Cross-Site Request Forgery to Arbitrary Options Update

High · published January 18, 2022

CVSS v3.1
8.8
EPSS
1%
Percentile
56.7
In the wild
Unconfirmed
What it is

The Login/Signup Popup, Waitlist Woocommerce ( Back in stock notifier ), and Side Cart Woocommerce (Ajax) WordPress plugins by XootiX are vulnerable to Cross-Site Request Forgery via the save_settings function found in the ~/includes/xoo-framework/admin/class-xoo-admin-settings.php file which makes it possible for attackers to update arbitrary options on a site that can be used to create an administrative user account and grant full privileged access to a compromised site. This affects versions <= 2.2 in Login/Signup Popup, versions <= 2.5.1 in Waitlist Woocommerce ( Back in stock notifier ), and versions <= 2.0 in Side Cart Woocommerce (Ajax).

The record
Technical detail
CVSS v3.1
8.8 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00817 · 56.7th percentile
Weakness
CWE-352 · Cross-Site Request Forgery (CSRF)
Published
2022-01-18T16:52Z
EPSS history
Timeline
  • 18 JAN 16:52Z
    XootiX Plugins <= Various Versions Cross-Site Request Forgery to Arbitrary Options Update
    cvelistv5