medium6.5
CVE-2018-11633
An issue was discovered in the MULTIDOTS Woo Checkout for Digital Goods plugin 2.1 for WordPress.
Impact
An issue was discovered in the MULTIDOTS Woo Checkout for Digital Goods plugin 2.1 for WordPress. If an admin user can be tricked into visiting a crafted URL created by an attacker (via spear phishing/social engineering), the attacker can change the plugin settings. The function woo_checkout_settings_page in the file class-woo-checkout-for-digital-goods-admin.php doesn't do any check against wp-admin/admin-post.php Cross-site request forgery (CSRF) and user capabilities.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Multidots | Woo Checkout For Digital Goods | Version 2.1 |
Weakness classification
References
- NVD record
- CVE.org record
- http://labs.threatpress.com/cross-site-request-forgery-csrf-in-woo-checkout-for-digital-goods-plugin/
- https://wordpress.org/plugins/woo-checkout-for-digital-goods/#developers
- http://labs.threatpress.com/cross-site-request-forgery-csrf-in-woo-checkout-for-digital-goods-plugin/
- https://wordpress.org/plugins/woo-checkout-for-digital-goods/#developers