CVE-2023-4940
BEAR <= 1.1.3.3 - Cross-Site Request Forgery to Product Manipulation
Severity Score
Exploit Likelihood
Affected Versions
Public Exploits
0Exploited in Wild
-Decision
Descriptions
The BEAR for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.1.3.3. This is due to missing or incorrect nonce validation on the woobe_bulkoperations_swap function. This makes it possible for unauthenticated attackers to manipulate products via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
BEAR para WordPress es vulnerable a Cross-Site Request Forgery (CSRF) en versiones hasta la 1.1.3.3 incluida. Esto se debe a una validación nonce faltante o incorrecta en la función woobe_bulk Operations_swap. Esto hace posible que atacantes no autenticados manipulen productos a través de una solicitud falsificada, siempre que puedan engañar al administrador del sitio para que realice una acción como hacer clic en un enlace.
CVSS Scores
SSVC
- Decision:-
Timeline
- 2023-09-13 CVE Reserved
- 2023-09-25 CVE Published
- 2024-08-02 CVE Updated
- 2024-09-19 EPSS Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
- ---------- First Exploit
CWE
- CWE-352: Cross-Site Request Forgery (CSRF)
CAPEC
References (3)
URL | Date | SRC |
---|
URL | Date | SRC |
---|
URL | Date | SRC |
---|
Affected Vendors, Products, and Versions
Vendor | Product | Version | Other | Status | ||||||
---|---|---|---|---|---|---|---|---|---|---|
Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
Pluginus Search vendor "Pluginus" | Bear - Woocommerce Bulk Editor And Products Manager Professional Search vendor "Pluginus" for product "Bear - Woocommerce Bulk Editor And Products Manager Professional" | <= 1.1.3.3 Search vendor "Pluginus" for product "Bear - Woocommerce Bulk Editor And Products Manager Professional" and version " <= 1.1.3.3" | wordpress |
Affected
|