Read the docs
TI-2022-03668 Aliases CVE-2022-3999GHSA-7rm4-78m3-r89p

WooCommerce Shipping - DPD baltic < 1.2.57 - Subscriber+ Arbitrary Options Deletion

Priority HIGH 68CWE-352Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Tampering, Security bypass
Confidentiality · integrity · availability
None · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA. Impact type from CWE-352 and CWE-862.

Summary

The DPD Baltic Shipping WordPress plugin before 1.2.57 does not have authorisation and CSRF in an AJAX action, which could allow any authenticated users, such as subscriber to delete arbitrary options from the blog, which could make the blog unavailable.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00445 38th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by the CNA and NVD
Fix Fixed DPD Baltic Shipping (Unknown): 1.2.57

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
UnknownDPD Baltic Shippingbefore 1.2.571.2.57Patch availableCNA
  • DPD Baltic Shipping VendorUnknown Affected before 1.2.57 Fixed in 1.2.57 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:dpdgroup:woocommerce_shipping:*:*:*:*:*:wordpress:*:*up to 1.2.11VulnerableDpdgroup
  • cpe:2.3:a:dpdgroup:woocommerce_shipping:*:*:*:*:*:wordpress:*:* Versions up to 1.2.11 Vulnerable ·Dpdgroup

Remediation

  • Fix · CNA DPD Baltic Shipping (Unknown) Fixed in 1.2.57

Timeline

  1. 2026-10-02 Threatist record created from CVE-2022-3999
  2. 2026-10-03 Alias added: GHSA-7rm4-78m3-r89p

References

Exploit 1

  • TI-2022-03669 WooCommerce Shipping - DPD baltic < 1.2.11 - Admin+ Stored XSS CVSS 3.1MEDIUM 4.8

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences