CVE-2022-3999
WooCommerce Shipping - DPD baltic < 1.2.57 - Subscriber+ Arbitrary Options Deletion
- State
- Published
- Severity
- 8.1 High
- Published
- Dec 12, 2022
- Updated
- Apr 22, 2025
- Reserved
- Nov 15, 2022
Description
The DPD Baltic Shipping WordPress plugin before 1.2.57 does not have authorisation and CSRF in an AJAX action, which could allow any authenticated users, such as subscriber to delete arbitrary options from the blog, which could make the blog unavailable.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.1 | 8.1 High | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H | CISA-ADP |
Weaknesses
The record names no weakness.
Affected Products
| Product | Versions |
|---|---|
DPD Baltic ShippingUnknown |
|
References
- https://wpscan.com/vulnerability/625ae924-68db-4579-a34f-e6f33aa33643exploitvdb-entrytechnical-description
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.