Multiple Plugins from Viszt Peter - Multiple CSRF
Priority LOW 31CWE-352Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- Required
- Attack complexity
- Low
- Impact type
- Tampering
- Confidentiality · integrity · availability
- None · High · Low
- Fix status
- Fixed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-352.
Summary
The Woo Billingo Plus WordPress plugin before 4.4.5.4, Integration for Billingo & Gravity Forms WordPress plugin before 1.0.4, Integration for Szamlazz.hu & Gravity Forms WordPress plugin before 1.2.7 are lacking CSRF checks in various AJAX actions, which could allow attackers to make logged in Shop Managers and above perform unwanted actions, such as deactivate the plugin's license
Why it matters now
EPSS 0.00413 35th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed Woo Billingo Plus (TODO): 4.4.5.4Integration for Billingo & Gravity Forms (TODO): 1.0.4+1 more product
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| TODO | Woo Billingo Plus | 4.4.5.4 to before 4.4.5.4 | 4.4.5.4 | Patch available | CNA |
| TODO | Integration for Billingo & Gravity Forms | 1.0.4 to before 1.0.4 | 1.0.4 | Patch available | CNA |
| TODO | Integration for Szamlazz.hu & Gravity Forms | 1.2.7 to before 1.2.7 | 1.2.7 | Patch available | CNA |
- Woo Billingo Plus VendorTODO Affected 4.4.5.4 to before 4.4.5.4 Fixed in 4.4.5.4 Patch available CNA
- Integration for Billingo & Gravity Forms VendorTODO Affected 1.0.4 to before 1.0.4 Fixed in 1.0.4 Patch available CNA
- Integration for Szamlazz.hu & Gravity Forms VendorTODO Affected 1.2.7 to before 1.2.7 Fixed in 1.2.7 Patch available CNA
CPE configurations NVD · 3
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:woo_billingo_plus_project:woo_billingo_plus:*:*:*:*:*:wordpress:*:* | before 4.4.5.4 | Vulnerable | Woo Billingo Plus Project |
| cpe:2.3:a:integration_for_billingo_\&_gravity_forms_project:integration_for_billingo_\&_gravity_forms:*:*:*:*:*:wordpress:*:* | before 1.0.4 | Vulnerable | Integration For Billingo & Gravity Forms Project |
| cpe:2.3:a:integration_for_szamlazz.hu_\&_gravity_forms_project:integration_for_szamlazz.hu_\&_gravity_forms:*:*:*:*:*:wordpress:*:* | before 1.2.7 | Vulnerable | Integration For Szamlazz.hu & Gravity Forms Project |
- cpe:2.3:a:woo_billingo_plus_project:woo_billingo_plus:*:*:*:*:*:wordpress:*:* Versions before 4.4.5.4 Vulnerable ·Woo Billingo Plus Project
- cpe:2.3:a:integration_for_billingo_\&_gravity_forms_project:integration_for_billingo_\&_gravity_forms:*:*:*:*:*:wordpress:*:* Versions before 1.0.4 Vulnerable ·Integration For Billingo & Gravity Forms Project
- cpe:2.3:a:integration_for_szamlazz.hu_\&_gravity_forms_project:integration_for_szamlazz.hu_\&_gravity_forms:*:*:*:*:*:wordpress:*:* Versions before 1.2.7 Vulnerable ·Integration For Szamlazz.hu & Gravity Forms Project
Remediation
- Fix · CNA Woo Billingo Plus (TODO) Fixed in 4.4.5.4
- Fix · CNA Integration for Billingo & Gravity Forms (TODO) Fixed in 1.0.4
- Fix · CNA Integration for Szamlazz.hu & Gravity Forms (TODO) Fixed in 1.2.7
Timeline
- 2026-10-02 Threatist record created from CVE-2022-3154
- 2026-10-03 Alias added: GHSA-2cx5-vjfr-g5qr
References
Sources
- CVE-2022-3154 · CVE Program
- CVE-2022-3154 · NVD
- FIRST EPSS
- GHSA-2cx5-vjfr-g5qr · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences