Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
1 selected

2 records

Release: WooCommerce Pre-Orders 2.0.3 Clear all filters
TI-2023-03274 CVE-2023-3508 · GHSA-wwxq-vcxp-5xwf

WooCommerce Pre-Orders < 2.0.3 - Unauthorised Actions via CSRF

Priority MEDIUM 62

The WooCommerce Pre-Orders WordPress plugin before 2.0.3 has a flawed CSRF check when processing its tab actions, which could allow attackers to make logged in admins email pre-orders customer, change the released date,…

CVSS 3.1MEDIUM 6.5 Network No auth User interaction EPSS 0.00307 Published 2023-07-31 Fixed in 2.0.3
TI-2023-03273 CVE-2023-3507 · GHSA-wq2f-vmcc-p4fr

WooCommerce Pre-Orders < 2.0.3 - Arbitrary Pre-Order Canceling via CSRF

Priority MEDIUM 62

The WooCommerce Pre-Orders WordPress plugin before 2.0.3 has a flawed CSRF check when canceling pre-orders, which could allow attackers to make logged in admins cancel arbitrary pre-orders via a CSRF attack

CVSS 3.1MEDIUM 6.5 Network No auth User interaction EPSS 0.00307 Published 2023-07-31 Fixed in 2.0.3