CVE-2022-3154

Multiple Plugins from Viszt Peter - Multiple CSRF

State: Published
Severity: Not scored
Published: Oct 10, 2022
Updated: Aug 3, 2024
Reserved: Sep 7, 2022

Description

The Woo Billingo Plus WordPress plugin before 4.4.5.4, Integration for Billingo & Gravity Forms WordPress plugin before 1.0.4, Integration for Szamlazz.hu & Gravity Forms WordPress plugin before 1.2.7 are lacking CSRF checks in various AJAX actions, which could allow attackers to make logged in Shop Managers and above perform unwanted actions, such as deactivate the plugin's license

Scores

The record has no CVSS score.

Weaknesses

CWE-352 Cross-Site Request Forgery (CSRF)

Affected Products

Product	Versions
Woo Billingo PlusTODO	4.4.5.4 to before 4.4.5.4Affected
Integration for Billingo & Gravity FormsTODO	1.0.4 to before 1.0.4Affected
Integration for Szamlazz.hu & Gravity FormsTODO	1.2.7 to before 1.2.7Affected

References

https://wpscan.com/vulnerability/cda978b2-b31f-495d-8601-0aaa3e4b45cd

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.