CVE-2022-2382CWE-352CWE-862
Product Slider for WooCommerce < 2.5.7 - Subscriber+ Arbitrary Options Deletion
published August 22, 2022
What it is
The Product Slider for WooCommerce WordPress plugin before 2.5.7 has flawed CSRF checks and lack authorisation in some of its AJAX actions, allowing any authenticated users, such as subscriber to call them. One in particular could allow them to delete arbitrary blog options.
The record
Technical detail
- CVSS
- Not scored
- CVSS v4.0
- Not supplied
- EPSS
- 0.00364 · 29.0th percentile
- Weaknesses
- CWE-352 · Cross-Site Request Forgery (CSRF); CWE-862 · Missing Authorization
- Published
- 2022-08-22T15:02Z
EPSS history
Timeline