Woocommerce Product Addons Vulnerabilities

The WooCommerce Product Add-ons plugin for WordPress is vulnerable to PHP Object Injection in versions up to, and including, 6.1.3 via deserialization of untrusted input. This allows authenticated attackers, with shop manager permissions and above, to inject a PHP Object. It is unknown if a POP chain is also present in...

CVSS:

7.2

Affected:

up to 6.1.3

Fixed in:

6.2.0

Disclosed:

May 15, 2023

CVE-2023-32795 on NVD →

The WooCommerce Product Add-ons plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 6.1.3. This is due to missing or incorrect nonce validation on one of its functions. This makes it possible for unauthenticated attackers to invoke this function via a forged request grante...

CVSS:

4.3

Affected:

up to 6.1.3

Fixed in:

6.2.0

Disclosed:

May 15, 2023

CVE-2023-32794 on NVD →