Yith Woocommerce Mailchimp Vulnerabilities

Several YITHEMES plugins for WordPress are vulnerable to authorization bypass due to a missing capability check on the create_log_file function. This makes it possible for authenticated attackers, with subscriber-level permissions and above, to download the logs of the plugin which can contain sensitive information. Pl...

CVSS:

7.1

Affected:

up to 2.5.0

Fix:

No patched version reported

Disclosed:

Nov 11, 2022

Several YITHEMES plugins for WordPress are vulnerable to Cross-Site Request Forgery. This is due to missing or incorrect nonce validation on the create_log_file function. This makes it possible for unauthenticated attackers to create an error or debug log file using the plugin, via forged request granted they can trick...

CVSS:

4.3

Affected:

up to 2.5.0

Fix:

No patched version reported

Disclosed:

Nov 11, 2022

CVE-2022-44630 on NVD →

Various versions of a various YITH WooCommerce plugins that use the YIT Plugin Framework through 3.3.8 are vulnerable to authorization bypass due to a missing capability check in the the 'save_toggle_element_options' function in .plugin-fw/lib/yit-plugin-panel-wc.php. This allows authenticated users with subscriber-lev...

CVSS:

4.3

Affected:

up to 2.1.3

Fixed in:

2.1.4

Disclosed:

Oct 31, 2019

CVE-2019-16251 on NVD →