Multiple Plugins from Addify - Multiple CSRF
Priority MEDIUM 62Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- Required
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- None · High · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA.
Summary
The Checkout Fields Manager WordPress plugin before 1.0.2, Abandoned Cart Recovery WordPress plugin before 1.2.5, Custom Fields for WooCommerce WordPress plugin before 1.0.4, Custom Order Number WordPress plugin through 1.0.1, Custom Registration Forms Builder WordPress plugin before 1.0.2, Advanced Free Gifts WordPress plugin before 1.0.2, Gift Registry for WooCommerce WordPress plugin through 1.0.1, Image Watermark for WooCommerce WordPress plugin before 1.0.1, Order Approval for WooCommerce WordPress plugin before 1.1.0, Order Tracking for WooCommerce WordPress plugin before 1.0.2, Price Calculator for WooCommerce WordPress plugin through 1.0.3, Product Dynamic Pricing and Discounts WordPress plugin through 1.0.6, Product Labels and Stickers WordPress plugin through 1.0.1 have flawed CSRF checks in various places, which could allow attackers to make logged in users perform unwanted actions
Why it matters now
Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00315 24th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by the CNA and NVD
Fix Fixed Checkout Fields Manager (Unknown): 1.0.2Abandoned Cart Recovery (Unknown): 1.2.5+6 more products
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Unknown | Checkout Fields Manager | before 1.0.2 | 1.0.2 | Patch available | CNA |
| Unknown | Abandoned Cart Recovery | before 1.2.5 | 1.2.5 | Patch available | CNA |
| Unknown | Custom Fields for WooCommerce | before 1.0.4 | 1.0.4 | Patch available | CNA |
| Unknown | Custom Order Number | up to 1.0.1 | — | No fix listed | CNA |
| Unknown | Custom Registration Forms Builder | before 1.0.2 | 1.0.2 | Patch available | CNA |
| Unknown | Advanced Free Gifts | before 1.0.2 | 1.0.2 | Patch available | CNA |
| Unknown | Gift Registry for WooCommerce | up to 1.0.1 | — | No fix listed | CNA |
| Unknown | Image Watermark for WooCommerce | before 1.0.1 | 1.0.1 | Patch available | CNA |
| Unknown | Order Approval for WooCommerce | before 1.1.0 | 1.1.0 | Patch available | CNA |
| Unknown | Order Tracking for WooCommerce | before 1.0.2 | 1.0.2 | Patch available | CNA |
| Unknown | Price Calculator for WooCommerce | up to 1.0.3 | — | No fix listed | CNA |
| Unknown | Product Dynamic Pricing and Discounts | up to 1.0.6 | — | No fix listed | CNA |
| Unknown | Product Labels and Stickers | up to 1.0.1 | — | No fix listed | CNA |
- Checkout Fields Manager VendorUnknown Affected before 1.0.2 Fixed in 1.0.2 Patch available CNA
- Abandoned Cart Recovery VendorUnknown Affected before 1.2.5 Fixed in 1.2.5 Patch available CNA
- Custom Fields for WooCommerce VendorUnknown Affected before 1.0.4 Fixed in 1.0.4 Patch available CNA
- Custom Order Number VendorUnknown Affected up to 1.0.1 Fixed in — No fix listed CNA
- Custom Registration Forms Builder VendorUnknown Affected before 1.0.2 Fixed in 1.0.2 Patch available CNA
- Advanced Free Gifts VendorUnknown Affected before 1.0.2 Fixed in 1.0.2 Patch available CNA
- Gift Registry for WooCommerce VendorUnknown Affected up to 1.0.1 Fixed in — No fix listed CNA
- Image Watermark for WooCommerce VendorUnknown Affected before 1.0.1 Fixed in 1.0.1 Patch available CNA
- Order Approval for WooCommerce VendorUnknown Affected before 1.1.0 Fixed in 1.1.0 Patch available CNA
- Order Tracking for WooCommerce VendorUnknown Affected before 1.0.2 Fixed in 1.0.2 Patch available CNA
- Price Calculator for WooCommerce VendorUnknown Affected up to 1.0.3 Fixed in — No fix listed CNA
- Product Dynamic Pricing and Discounts VendorUnknown Affected up to 1.0.6 Fixed in — No fix listed CNA
- Product Labels and Stickers VendorUnknown Affected up to 1.0.1 Fixed in — No fix listed CNA
CPE configurations NVD · 10
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:addify:abandoned_cart_recovery:*:*:*:*:*:wordpress:*:* | before 1.2.5 | Vulnerable | Addify |
| cpe:2.3:a:addify:advanced_free_gifts:*:*:*:*:*:wordpress:*:* | before 1.0.2 | Vulnerable | Addify |
| cpe:2.3:a:addify:checkout_fields_manager:*:*:*:*:*:wordpress:*:* | before 1.0.2 | Vulnerable | Addify |
| cpe:2.3:a:addify:custom_fields_for_woocommerce:*:*:*:*:*:wordpress:*:* | before 1.0.4 | Vulnerable | Addify |
| cpe:2.3:a:addify:custom_order_number:*:*:*:*:*:wordpress:*:* | up to 1.0.1 | Vulnerable | Addify |
| cpe:2.3:a:addify:custom_registration_forms_builder:*:*:*:*:*:wordpress:*:* | before 1.0.2 | Vulnerable | Addify |
| cpe:2.3:a:addify:gift_registry_for_woocommerce:*:*:*:*:*:wordpress:*:* | up to 1.0.1 | Vulnerable | Addify |
| cpe:2.3:a:addify:image_watermark_for_woocommerce:*:*:*:*:*:wordpress:*:* | up to 1.0.1 | Vulnerable | Addify |
| cpe:2.3:a:addify:order_approval_for_woocommerce:*:*:*:*:*:wordpress:*:* | before 1.1.0 | Vulnerable | Addify |
| cpe:2.3:a:addify:order_tracking_for_woocommerce:*:*:*:*:*:wordpress:*:* | before 1.0.2 | Vulnerable | Addify |
- cpe:2.3:a:addify:abandoned_cart_recovery:*:*:*:*:*:wordpress:*:* Versions before 1.2.5 Vulnerable ·Addify
- cpe:2.3:a:addify:advanced_free_gifts:*:*:*:*:*:wordpress:*:* Versions before 1.0.2 Vulnerable ·Addify
- cpe:2.3:a:addify:checkout_fields_manager:*:*:*:*:*:wordpress:*:* Versions before 1.0.2 Vulnerable ·Addify
- cpe:2.3:a:addify:custom_fields_for_woocommerce:*:*:*:*:*:wordpress:*:* Versions before 1.0.4 Vulnerable ·Addify
- cpe:2.3:a:addify:custom_order_number:*:*:*:*:*:wordpress:*:* Versions up to 1.0.1 Vulnerable ·Addify
- cpe:2.3:a:addify:custom_registration_forms_builder:*:*:*:*:*:wordpress:*:* Versions before 1.0.2 Vulnerable ·Addify
- cpe:2.3:a:addify:gift_registry_for_woocommerce:*:*:*:*:*:wordpress:*:* Versions up to 1.0.1 Vulnerable ·Addify
- cpe:2.3:a:addify:image_watermark_for_woocommerce:*:*:*:*:*:wordpress:*:* Versions up to 1.0.1 Vulnerable ·Addify
- cpe:2.3:a:addify:order_approval_for_woocommerce:*:*:*:*:*:wordpress:*:* Versions before 1.1.0 Vulnerable ·Addify
- cpe:2.3:a:addify:order_tracking_for_woocommerce:*:*:*:*:*:wordpress:*:* Versions before 1.0.2 Vulnerable ·Addify
Remediation
- Fix · CNA Checkout Fields Manager (Unknown) Fixed in 1.0.2
- Fix · CNA Abandoned Cart Recovery (Unknown) Fixed in 1.2.5
- Fix · CNA Custom Fields for WooCommerce (Unknown) Fixed in 1.0.4
- Fix · CNA Custom Registration Forms Builder (Unknown) Fixed in 1.0.2
- Fix · CNA Advanced Free Gifts (Unknown) Fixed in 1.0.2
- Fix · CNA Image Watermark for WooCommerce (Unknown) Fixed in 1.0.1
- Fix · CNA Order Approval for WooCommerce (Unknown) Fixed in 1.1.0
- Fix · CNA Order Tracking for WooCommerce (Unknown) Fixed in 1.0.2
Timeline
- 2026-10-02 Threatist record created from CVE-2022-4888
- 2026-10-03 Alias added: GHSA-89vq-qmxv-5v45
References
Sources
- CVE-2022-4888 · CVE Program
- CVE-2022-4888 · NVD
- FIRST EPSS
- GHSA-89vq-qmxv-5v45 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences