Vulnerabilities

TI-2023-23688 CVE-2023-44148 · GHSA-3mcj-h4q6-5xgm

WordPress Astra Bulk Edit plugin <= 1.2.7 - Broken Access Control vulnerability

LOW 38

Missing Authorization vulnerability in Brainstorm Force Astra Bulk Edit.This issue affects Astra Bulk Edit: from n/a through 1.2.7.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00387 Published 2024-06-19 No fix listed CWE-862

TI-2023-27234 CVE-2023-49830 · GHSA-7v8c-cpfm-gx98

WordPress Astra Pro Plugin <= 4.3.1 is vulnerable to Remote Code Execution (RCE)

MEDIUM 43

Improper Control of Generation of Code ('Code Injection') vulnerability in Brainstorm Force Astra Pro.This issue affects Astra Pro: from n/a through 4.3.1.

CVSS 3.1CRITICAL 9.9 Network Low privileges No interaction EPSS 0.00655 Published 2023-12-29 No fix listed CWE-94

TI-2021-06794 CVE-2021-24507 · GHSA-5ph3-gq38-phg6

Astra Pro Addon < 3.5.2 - Unauthenticated SQL Injection

MEDIUM 55

The Astra Pro Addon WordPress plugin before 3.5.2 did not properly sanitise or escape some of the POST parameters from the astra_pagination_infinite and astra_shop_pagination_infinite AJAX action (available to both unaut…

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.11004 Published 2021-08-09 Fixed in 3.5.2 CWE-89

Vulnerabilities

Filters

WordPress Astra Bulk Edit plugin <= 1.2.7 - Broken Access Control vulnerability

WordPress Astra Pro Plugin <= 4.3.1 is vulnerable to Remote Code Execution (RCE)

Astra Pro Addon < 3.5.2 - Unauthenticated SQL Injection