Medium severity · published Aug 22, 2022
CVE-2022-2382
Product Slider for WooCommerce < 2.5.7 - Subscriber+ Arbitrary Options Deletion
4.3
CVSS
0.4%
EPSS
No
On KEV
Description
The Product Slider for WooCommerce WordPress plugin before 2.5.7 has flawed CSRF checks and lack authorisation in some of its AJAX actions, allowing any authenticated users, such as subscriber to call them. One in particular could allow them to delete arbitrary blog options.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
None
Integrity
Low
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 30% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
PS
Product Slider for WooCommerce ·
2.5.7 before 2.5.7 · source: vendor, NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2022-2382
CVE.org
https://www.cve.org/CVERecord?id=CVE-2022-2382
Exploit
https://wpscan.com/vulnerability/777d4637-444b-4eda-bc21-95d3a3bf6cd3
More from Product Slider for WooCommerce
5.4
CVE-2022-4629
Product Slider for WooCommerce < 2.6.4 - Contributor+ Stored XSS in Shortcode