CVE-2022-2432

The Ecwid Ecommerce Shopping Cart plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 6.10.23. This is due to missing or incorrect nonce validation on the ecwid_update_plugin_params function. This makes it possible for unauthenticated attackers to update plugin options granted they can trick a site administrator into performing an action such as clicking on a link.
Configurations

Configuration 1 (hide)

cpe:2.3:a:lightspeedhq:ecwid_ecommerce_shopping_cart:*:*:*:*:*:wordpress:*:*

History

No history.

Information

Published : 2022-09-06 18:15

Updated : 2022-09-09 02:58


NVD link : CVE-2022-2432

Mitre link : CVE-2022-2432

CVE.ORG link : CVE-2022-2432


JSON object : View

Products Affected

lightspeedhq

  • ecwid_ecommerce_shopping_cart
CWE
CWE-352

Cross-Site Request Forgery (CSRF)