Skip to main content
cve.nowby Sazabi
← All vulnerabilities
CVE-2022-0215

XootiX Plugins <= Various Versions Cross-Site Request Forgery to Arbitrary Options Update

Published
Last modified
published
Not listed in CISA KEV
None on Exploit-DB, Metasploit or GitHub
  • Exploitation: none
  • Automatable: no
  • Technical impact: total

Summary

The Login/Signup Popup, Waitlist Woocommerce ( Back in stock notifier ), and Side Cart Woocommerce (Ajax) WordPress plugins by XootiX are vulnerable to Cross-Site Request Forgery via the save_settings function found in the ~/includes/xoo-framework/admin/class-xoo-admin-settings.php file which makes it possible for attackers to update arbitrary options on a site that can be used to create an administrative user account and grant full privileged access to a compromised site. This affects versions <= 2.2 in Login/Signup Popup, versions <= 2.5.1 in Waitlist Woocommerce ( Back in stock notifier ), and versions <= 2.0 in Side Cart Woocommerce (Ajax).

Timeline

  1. CVE published
  2. CISA SSVC assessment

    Exploitation: none · Automatable: no · Technical impact: total

  3. Record last updated

Affected versions

  • XootiX Login/Signup Popup

    From 2.2 · through 2.2

  • XootiX Waitlist Woocommerce ( Back in stock notifier )

    From 2.5.1 · through 2.5.1

  • XootiX Side Cart Woocommerce (Ajax)

    From 2.0 · through 2.0

References 5

wordfence.com

plugins.trac.wordpress.org