WooCommerce < 10.5.3 - Arbitrary Admin User Creation via CSRF
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- Fix
- Fixed in 5.4.4, 5.4.5, 5.6.3, 5.7.3, 5.8.2, and 47 more
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
- Exploitation: none
- Automatable: no
- Technical impact: total
Summary
The WooCommerce WordPress plugin from versions 5.4.0 to 10.5.2 does not properly handle batch requests, which could allow unauthenticated users to make a logged in admin call non store/WC REST endpoints, and create arbitrary admin users via a CSRF attack for example.
Timeline
- CVE published
- CISA SSVC assessment
Exploitation: none · Automatable: no · Technical impact: total
- Record last updated
Affected versions
- Automattic WooCommerce
From 5.4.0 · fixed in 5.4.4; From 5.5.0 · fixed in 5.4.5; From 5.6.0 · fixed in 5.6.3; From 5.7.0 · fixed in 5.7.3; From 5.8.0 · fixed in 5.8.2; From 5.9.0 · fixed in 5.9.2; From 6.0.0 · fixed in 6.0.2; From 6.1.0 · fixed in 6.1.3; From 6.2.0 · fixed in 6.2.3; From 6.3.0 · fixed in 6.3.2; From 6.4.0 · fixed in 6.4.2; From 6.5.0 · fixed in 6.5.2; From 6.6.0 · fixed in 6.6.2; From 6.7.0 · fixed in 6.7.1; From 6.8.0 · fixed in 6.8.3; From 6.9.0 · fixed in 6.9.5; From 7.0.0 · fixed in 7.0.2; From 7.1.0 · fixed in 7.1.2; From 7.2.0 · fixed in 7.2.4; From 7.3.0 · fixed in 7.3.1; From 7.4.0 · fixed in 7.4.2; From 7.5.0 · fixed in 7.5.2; From 7.6.0 · fixed in 7.6.2; From 7.7.0 · fixed in 7.7.3; From 7.8.0 · fixed in 7.8.4; From 7.9.0 · fixed in 7.9.2; From 8.0.0 · fixed in 8.0.5; From 8.1.0 · fixed in 8.1.4; From 8.2.0 · fixed in 8.2.5; From 8.3.0 · fixed in 8.3.4; From 8.4.0 · fixed in 8.4.3; From 8.5.0 · fixed in 8.5.5; From 8.6.0 · fixed in 8.6.4; From 8.7.0 · fixed in 8.7.3; From 8.8.0 · fixed in 8.8.7; From 8.9.0 · fixed in 8.9.5; From 9.0.0 · fixed in 9.0.4; From 9.1.0 · fixed in 9.1.7; From 9.2.0 · fixed in 9.2.5; From 9.3.0 · fixed in 9.3.6; From 9.4.0 · fixed in 9.4.5; From 9.5.0 · fixed in 9.5.4; From 9.6.0 · fixed in 9.6.4; From 9.7.0 · fixed in 9.7.3; From 9.8.0 · fixed in 9.8.7; From 9.9.0 · fixed in 9.9.7; From 10.0.0 · fixed in 10.0.6; From 10.1.0 · fixed in 10.1.4; From 10.2.0 · fixed in 10.2.4; From 10.3.0 · fixed in 10.3.8; From 10.4.0 · fixed in 10.4.4; From 10.5.0 · fixed in 10.5.3