CVE-2024-2322medium

CVE-2024-2322: fallo de gravedad media en WooCommerce Cart Abandonment Recovery

WooCommerce Cart Abandonment Recovery < 1.2.27 - Templates/Abandoned Orders Deletion via CSRF

Publicada el · Actualizada el

Seguir esta CVE+ Monitorear Cart Abandonment Recovery

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

13Vexday Risk Score

Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.

ssvc Trackcvss 6.8epss 0.4%
The WooCommerce Cart Abandonment Recovery WordPress plugin before 1.2.27 does not have CSRF check in its bulk actions, which could allow attackers to make logged in admins delete arbitrary email templates as well as delete and unsubscribe users from abandoned orders via CSRF attacks.
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H
Productos afectados
Unknown · WooCommerce Cart Abandonment Recovery