CVE-2022-4888

Public Exploit

Multiple Plugins from Addify - Multiple CSRF

Description

The Checkout Fields Manager WordPress plugin before 1.0.2, Abandoned Cart Recovery WordPress plugin before 1.2.5, Custom Fields for WooCommerce WordPress plugin before 1.0.4, Custom Order Number WordPress plugin through 1.0.1, Custom Registration Forms Builder WordPress plugin before 1.0.2, Advanced Free Gifts WordPress plugin before 1.0.2, Gift Registry for WooCommerce WordPress plugin through 1.0.1, Image Watermark for WooCommerce WordPress plugin before 1.0.1, Order Approval for WooCommerce WordPress plugin before 1.1.0, Order Tracking for WooCommerce WordPress plugin before 1.0.2, Price Calculator for WooCommerce WordPress plugin through 1.0.3, Product Dynamic Pricing and Discounts WordPress plugin through 1.0.6, Product Labels and Stickers WordPress plugin through 1.0.1 have flawed CSRF checks in various places, which could allow attackers to make logged in users perform unwanted actions

6.5

CVSS

Severity: Medium

CVSS 3.1 •

EPSS 0.35%

Third-Party Advisory wpscan.com

Affected: Unknown Checkout Fields Manager

Affected: Unknown Abandoned Cart Recovery

Affected: Unknown Custom Fields for WooCommerce

Affected: Unknown Custom Order Number

Affected: Unknown Custom Registration Forms Builder

Affected: Unknown Advanced Free Gifts

Affected: Unknown Gift Registry for WooCommerce

Affected: Unknown Image Watermark for WooCommerce

Affected: Unknown Order Approval for WooCommerce

Affected: Unknown Order Tracking for WooCommerce

Affected: Unknown Price Calculator for WooCommerce

Affected: Unknown Product Dynamic Pricing and Discounts

Affected: Unknown Product Labels and Stickers

References

Link	Tags
https://wpscan.com/vulnerability/2c2379d0-e373-4587-a747-429d7ee8f6cc	third party advisory vdb entry exploit technical description

Frequently Asked Questions

What is the severity of CVE-2022-4888?: CVE-2022-4888 has been scored as a medium severity vulnerability.
How to fix CVE-2022-4888?: To fix CVE-2022-4888, make sure you are using an up-to-date version of the affected component(s) by checking the vendor release notes. As for now, there are no other specific guidelines available.
Is CVE-2022-4888 being actively exploited in the wild?: It is possible that CVE-2022-4888 is being exploited or will be exploited in a near future based on public information. According to its EPSS score, there is a ~0% probability that this vulnerability will be exploited by malicious actors in the next 30 days.
What software or system is affected by CVE-2022-4888?: CVE-2022-4888 affects Unknown Checkout Fields Manager, Unknown Abandoned Cart Recovery, Unknown Custom Fields for WooCommerce, Unknown Custom Order Number, Unknown Custom Registration Forms Builder, Unknown Advanced Free Gifts, Unknown Gift Registry for WooCommerce, Unknown Image Watermark for WooCommerce, Unknown Order Approval for WooCommerce, Unknown Order Tracking for WooCommerce, Unknown Price Calculator for WooCommerce, Unknown Product Dynamic Pricing and Discounts, Unknown Product Labels and Stickers.