Multiple Plugins from Addify - Multiple CSRF

Summary

The Checkout Fields Manager WordPress plugin before 1.0.2, Abandoned Cart Recovery WordPress plugin before 1.2.5, Custom Fields for WooCommerce WordPress plugin before 1.0.4, Custom Order Number WordPress plugin through 1.0.1, Custom Registration Forms Builder WordPress plugin before 1.0.2, Advanced Free Gifts WordPress plugin before 1.0.2, Gift Registry for WooCommerce WordPress plugin through 1.0.1, Image Watermark for WooCommerce WordPress plugin before 1.0.1, Order Approval for WooCommerce WordPress plugin before 1.1.0, Order Tracking for WooCommerce WordPress plugin before 1.0.2, Price Calculator for WooCommerce WordPress plugin through 1.0.3, Product Dynamic Pricing and Discounts WordPress plugin through 1.0.6, Product Labels and Stickers WordPress plugin through 1.0.1 have flawed CSRF checks in various places, which could allow attackers to make logged in users perform unwanted actions

Timeline

1. Jul 31, 2023, 9:37 AM UTCCVE published
2. Oct 17, 2024, 8:55 PM UTCCISA SSVC assessment

   Exploitation: poc · Automatable: no · Technical impact: partial

3. Oct 17, 2024, 9:09 PM UTCRecord last updated

Affected versions

• Unknown Checkout Fields Manager

  fixed in 1.0.2

• Unknown Abandoned Cart Recovery

  fixed in 1.2.5

• Unknown Custom Fields for WooCommerce

  fixed in 1.0.4

• Unknown Custom Order Number

  through 1.0.1

• Unknown Custom Registration Forms Builder

  fixed in 1.0.2

• Unknown Advanced Free Gifts

  fixed in 1.0.2

• Unknown Gift Registry for WooCommerce

  through 1.0.1

• Unknown Image Watermark for WooCommerce

  fixed in 1.0.1

• Unknown Order Approval for WooCommerce

  fixed in 1.1.0

• Unknown Order Tracking for WooCommerce

  fixed in 1.0.2

• Unknown Price Calculator for WooCommerce

  through 1.0.3

• Unknown Product Dynamic Pricing and Discounts

  through 1.0.6

• Unknown Product Labels and Stickers

  through 1.0.1

References 1