CVSS: 9.8EPSS: 0%CPEs: 1EXPL: 1CVE-2023-4703 – All in One B2B for WooCommerce <= 1.0.3 - Unauthenticated Privilege Escalation
https://notcve.org/view.php?id=CVE-2023-4703
The All in One B2B for WooCommerce WordPress plugin through 1.0.3 does not properly validate parameters when updating user details, allowing an unauthenticated attacker to update the details of any user. Updating the password of an Admin user leads to privilege escalation. El complemento de WordPress All in One B2B para WooCommerce hasta la versión 1.0.3 no valida correctamente los parámetros al actualizar los detalles del usuario, lo que permite a un atacante no autenticado actualizar los detalles de cualquier usuario. Actualizar la contraseña de un usuario Admin conduce a una escalada de privilegios. The All in One B2B for WooCommerce plugin for WordPress is vulnerable to Privilege Escalation in versions up to, and including, 1.0.3. • https://wpscan.com/vulnerability/83278bbb-90e6-4465-a46d-60b4c703c11a • CWE-269: Improper Privilege Management •
CVSS: 8.8EPSS: 0%CPEs: 1EXPL: 1CVE-2023-3547 – All in One B2B for WooCommerce <= 1.0.3 - Multiple CSRF
https://notcve.org/view.php?id=CVE-2023-3547
The All in One B2B for WooCommerce WordPress plugin through 1.0.3 does not properly check nonce values in several actions, allowing an attacker to perform CSRF attacks. El complemento de WordPress All in One B2B para WooCommerce hasta la versión 1.0.3 no verifica correctamente los valores nonce en varias acciones, lo que permite a un atacante realizar ataques CSRF. The All in One B2B for WooCommerce plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.0.3. This is due to missing or incorrect nonce validation affecting several actions. This makes it possible for unauthenticated attackers to perform unauthorized actions via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. • https://wpscan.com/vulnerability/3cfb6696-18ad-4a38-9ca3-992f0b768b78 • CWE-352: Cross-Site Request Forgery (CSRF) •