CVSS: 4.3EPSS: %CPEs: 1EXPL: 0CVE-2023-36506 – YITH WooCommerce Waiting List <= 2.6.0 - Cross-Site Request forgery via 'save_mail_status'
https://notcve.org/view.php?id=CVE-2023-36506
The YITH WooCommerce Waiting List plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.6.0. This is due to missing or incorrect nonce validation on the 'save_mail_status' function. This makes it possible for unauthenticated attackers to enable or disable email notifications via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. • CWE-862: Missing Authorization •
CVSS: 4.3EPSS: 0%CPEs: 38EXPL: 0CVE-2019-16251 – YIT Plugin Framework <= 3.3.8 - Authenticated Settings Change
https://notcve.org/view.php?id=CVE-2019-16251
plugin-fw/lib/yit-plugin-panel-wc.php in the YIT Plugin Framework through 3.3.8 for WordPress allows authenticated options changes. el archivo plugin-fw/lib/yit-plugin-panel-wc.php en YIT Plugin Framework versiones hasta 3.3.8 para WordPress, permite cambios de opciones autenticados. Various versions of a various YITH WooCommerce plugins that use the YIT Plugin Framework through 3.3.8 are vulnerable to authorization bypass due to a missing capability check in the the 'save_toggle_element_options' function in .plugin-fw/lib/yit-plugin-panel-wc.php. This allows authenticated users with subscriber-level permissions or above to change arbitrary plugin settings. • https://blog.nintechnet.com/authenticated-settings-change-vulnerability-in-yit-plugin-framework https://wpvulndb.com/vulnerabilities/9932 • CWE-862: Missing Authorization •