CVE-2022-4935 Vulnerability Details

  /     /     /  

CVE-2022-4935 Metadata Quick Info

CVE Published: 05/04/2023 | CVE Updated: 03/08/2024 | CVE Year: 2022
Source: Wordfence | Vendor: wclovers | Product: WCFM Marketplace – Best Multivendor Marketplace for WooCommerce
Status : PUBLISHED

---

CVE-2022-4935 Description

The WCFM Marketplace plugin for WordPress is vulnerable to unauthorized modification and access of data in versions up to, and including, 3.4.11 due to missing capability checks on various AJAX actions. This makes it possible for authenticated attackers, with minimal permissions such as subscribers, to perform a wide variety of actions such as modifying shipping method details, modifying products, deleting arbitrary posts, and privilege escalation (via the wp_ajax_wcfm_vendor_store_online AJAX action).

Metrics

CVSS Version: 3.1 | Base Score: 8.8 HIGH
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

l➤ Exploitability Metrics:
    Attack Vector (AV)*
    Attack Complexity (AC)*
    Privileges Required (PR)*
    User Interaction (UI)*
    Scope (S)*

l➤ Impact Metrics:
    Confidentiality Impact (C)*
    Integrity Impact (I)*
    Availability Impact (A)*

Weakness Enumeration (CWE)

CWE-ID:
CWE Name: CWE-89 Improper Neutralization of Special Elements used in an SQL Command ( SQL Injection )
Source: wclovers

Common Attack Pattern Enumeration and Classification (CAPEC)

CAPEC-ID:
CAPEC Description:


Source: NVD (National Vulnerability Database).