Woo Product Table < 3.1.2 - Unauthenticated Arbitrary Function Call
Priority MEDIUM 64CWE-352Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Tampering, Security bypass
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-352 and CWE-862.
Summary
The Product Table for WooCommerce (wooproducttable) WordPress plugin before 3.1.2 does not have authorisation and CSRF checks in the wpt_admin_update_notice_option AJAX action (available to both unauthenticated and authenticated users), as well as does not validate the callback parameter, allowing unauthenticated attackers to call arbitrary functions with either none or one user controlled argument
Why it matters now
EPSS 0.25937 97th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed Product Table for WooCommerce (wooproducttable) (Unknown): 3.1.2
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Unknown | Product Table for WooCommerce (wooproducttable) | 3.0.2 and later; 3.1.2 to before 3.1.2 | 3.1.2 | Patch available | CNA |
- Product Table for WooCommerce (wooproducttable) VendorUnknown Affected 3.0.2 and later; 3.1.2 to before 3.1.2 Fixed in 3.1.2 Patch available CNA
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:codeastrology:woo_product_table:*:*:*:*:*:wordpress:*:* | before 3.1.2 | Vulnerable | codersaiful |
- cpe:2.3:a:codeastrology:woo_product_table:*:*:*:*:*:wordpress:*:* Versions before 3.1.2 Vulnerable ·codersaiful
Remediation
- Fix · CNA Product Table for WooCommerce (wooproducttable) (Unknown) Fixed in 3.1.2
Timeline
- 2026-10-02 Threatist record created from CVE-2022-1020
- 2026-10-03 Alias added: GHSA-fvgr-6h35-229m
References
More codersaiful Woo Product Table vulnerabilities
- TI-2024-10025 Product Table for WooCommerce by CodeAstrology (wooproducttable.com) <= 3.5.1 - Information Exposure CVSS 3.1HIGH 7.5
Sources
- CVE-2022-1020 · CVE Program
- CVE-2022-1020 · NVD
- FIRST EPSS
- GHSA-fvgr-6h35-229m · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences