← Back

CVE-2022-3459

nvd nist
Published: Sep 14, 2024Modified: Sep 27, 2024

JSON object

Loading...
5.3
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Exploitability: 3.9 / Impact: 1.4
Source: security@wordfence.com (Secondary)

Description

The WooCommerce Multiple Free Gift plugin for WordPress is vulnerable to gift manipulation in all versions up to, and including, 1.2.3. This is due to plugin not enforcing server-side checks on the products that can be added as a gift. This makes it possible for unauthenticated attackers to add non-gift items to their cart as a gift.

Affected (1)

Lilmonkee
1 product
Woocommerce Multiple Free Gift
Configuration A
1 vulnerable
Vulnerable SoftwareAffected Versions
Woocommerce Multiple Free Gift
Up to 1.2.3

Related CWEs

CWE-639
Authorization Bypass Through User-Controlled Key
The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

References (2)

Source: security@wordfence.com
Product
Source: security@wordfence.com
Third Party Advisory

Timeline

No history available yet.