Lucene search

[email protected]CVE-2021-4337

HistoryJun 07, 2023 - 1:15 p.m.

CVE-2021-4337

2023-06-0713:15:09

CWE-862

[email protected]

web.nvd.nist.gov

cve-2021-4337

wordpress

vulnerability

authorization bypass

plugin

security issue

8.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

8.2 High

AI Score

Confidence

High

0.002 Low

EPSS

Percentile

54.3%

JSON

Sixteen XforWooCommerce Add-On Plugins for WordPress are vulnerable to authorization bypass due to a missing capability check on the wp_ajax_svx_ajax_factory function in various versions listed below. This makes it possible for authenticated attackers, with subscriber-level permissions and above, to read, edit, or delete WordPress settings, plugin settings, and to arbitrarily list all users on a WordPress website. The plugins impacted are: Product Filter for WooCommerce < 8.2.0, Improved Product Options for WooCommerce < 5.3.0, Improved Sale Badges for WooCommerce < 4.4.0, Share, Print and PDF Products for WooCommerce < 2.8.0, Product Loops for WooCommerce < 1.7.0, XforWooCommerce < 1.7.0, Package Quantity Discount < 1.2.0, Price Commander for WooCommerce < 1.3.0, Comment and Review Spam Control for WooCommerce < 1.5.0, Add Product Tabs for WooCommerce < 1.5.0, Autopilot SEO for WooCommerce < 1.6.0, Floating Cart < 1.3.0, Live Search for WooCommerce < 2.1.0, Bulk Add to Cart for WooCommerce < 1.3.0, Live Product Editor for WooCommerce < 4.7.0, and Warranties and Returns for WooCommerce < 5.3.0.

Affected configurations

Vulners

NVD

Node

xforwoocommerceproduct_filterRange<8.2.0

xforwoocommerceimproved_sale_badgesRange<4.4.0

xforwoocommercexforwoocommerceRange<1.7.0

xforwoocommercelive_product_editorRange<4.7.0

xforwoocommercewarranties_and_returnsRange<5.3.0

xforwoocommerceprice_commanderRange<1.3.0

xforwoocommerceimproved_product_optionsRange<5.3.0

xforwoocommercecomment_and_review_spam_controlRange<1.5.0

xforwoocommercepackage_quantityRange<1.2.0

xforwoocommerceshare\,_print_and_pdf_productsRange<2.8.0

xforwoocommercebulk_add_to_cartRange<1.3.0

xforwoocommercelive_searchRange<2.1.0

xforwoocommercefloating_cartRange<1.3.0

xforwoocommerceadd_product_tabsRange<1.5.0

xforwoocommerceproduct_loopsRange<1.7.0

xforwoocommerceautopilot_seoRange<1.6.0

VendorProductVersionCPE
xforwoocommerceproduct_filter*cpe:2.3:a:xforwoocommerce:product_filter:*:*:*:*:*:*:*:*
xforwoocommerceimproved_sale_badges*cpe:2.3:a:xforwoocommerce:improved_sale_badges:*:*:*:*:*:*:*:*
xforwoocommercexforwoocommerce*cpe:2.3:a:xforwoocommerce:xforwoocommerce:*:*:*:*:*:*:*:*
xforwoocommercelive_product_editor*cpe:2.3:a:xforwoocommerce:live_product_editor:*:*:*:*:*:*:*:*
xforwoocommercewarranties_and_returns*cpe:2.3:a:xforwoocommerce:warranties_and_returns:*:*:*:*:*:*:*:*
xforwoocommerceprice_commander*cpe:2.3:a:xforwoocommerce:price_commander:*:*:*:*:*:*:*:*
xforwoocommerceimproved_product_options*cpe:2.3:a:xforwoocommerce:improved_product_options:*:*:*:*:*:*:*:*
xforwoocommercecomment_and_review_spam_control*cpe:2.3:a:xforwoocommerce:comment_and_review_spam_control:*:*:*:*:*:*:*:*
xforwoocommercepackage_quantity*cpe:2.3:a:xforwoocommerce:package_quantity:*:*:*:*:*:*:*:*
xforwoocommerceshare\,_print_and_pdf_products*cpe:2.3:a:xforwoocommerce:share\,_print_and_pdf_products:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
xforwoocommerce	product_filter	*	cpe:2.3:a:xforwoocommerce:product_filter::::::::
xforwoocommerce	improved_sale_badges	*	cpe:2.3:a:xforwoocommerce:improved_sale_badges::::::::
xforwoocommerce	xforwoocommerce	*	cpe:2.3:a:xforwoocommerce:xforwoocommerce::::::::
xforwoocommerce	live_product_editor	*	cpe:2.3:a:xforwoocommerce:live_product_editor::::::::
xforwoocommerce	warranties_and_returns	*	cpe:2.3:a:xforwoocommerce:warranties_and_returns::::::::
xforwoocommerce	price_commander	*	cpe:2.3:a:xforwoocommerce:price_commander::::::::
xforwoocommerce	improved_product_options	*	cpe:2.3:a:xforwoocommerce:improved_product_options::::::::
xforwoocommerce	comment_and_review_spam_control	*	cpe:2.3:a:xforwoocommerce:comment_and_review_spam_control::::::::
xforwoocommerce	package_quantity	*	cpe:2.3:a:xforwoocommerce:package_quantity::::::::
xforwoocommerce	share\,_print_and_pdf_products	*	cpe:2.3:a:xforwoocommerce:share\,_print_and_pdf_products::::::::

Rows per page:

1-10 of 161

CNA Affected

[
  {
    "vendor": "XforWooCommerce",
    "product": "Product Filter for WooCommerce",
    "versions": [
      {
        "version": "*",
        "status": "affected",
        "lessThan": "8.2.0",
        "versionType": "semver"
      }
    ],
    "defaultStatus": "unaffected"
  },
  {
    "vendor": "XforWooCommerce",
    "product": "Improved Sale Badges for WooCommerce",
    "versions": [
      {
        "version": "*",
        "status": "affected",
        "lessThan": "4.4.0",
        "versionType": "semver"
      }
    ],
    "defaultStatus": "unaffected"
  },
  {
    "vendor": "XforWooCommerce",
    "product": "XforWooCommerce",
    "versions": [
      {
        "version": "*",
        "status": "affected",
        "lessThan": "1.7.0",
        "versionType": "semver"
      }
    ],
    "defaultStatus": "unaffected"
  },
  {
    "vendor": "XforWooCommerce",
    "product": "Live Product Editor for WooCommerce",
    "versions": [
      {
        "version": "*",
        "status": "affected",
        "lessThan": "4.7.0",
        "versionType": "semver"
      }
    ],
    "defaultStatus": "unaffected"
  },
  {
    "vendor": "XforWooCommerce",
    "product": "Warranties and Returns for WooCommerce",
    "versions": [
      {
        "version": "*",
        "status": "affected",
        "lessThan": "5.3.0",
        "versionType": "semver"
      }
    ],
    "defaultStatus": "unaffected"
  },
  {
    "vendor": "XforWooCommerce",
    "product": "Price Commander for WooCommerce",
    "versions": [
      {
        "version": "*",
        "status": "affected",
        "lessThan": "1.3.0",
        "versionType": "semver"
      }
    ],
    "defaultStatus": "unaffected"
  },
  {
    "vendor": "XforWooCommerce",
    "product": "Improved Product Options for WooCommerce",
    "versions": [
      {
        "version": "*",
        "status": "affected",
        "lessThan": "5.3.0",
        "versionType": "semver"
      }
    ],
    "defaultStatus": "unaffected"
  },
  {
    "vendor": "XforWooCommerce",
    "product": "Comment and Review Spam Control for WooCommerce",
    "versions": [
      {
        "version": "*",
        "status": "affected",
        "lessThan": "1.5.0",
        "versionType": "semver"
      }
    ],
    "defaultStatus": "unaffected"
  },
  {
    "vendor": "XforWooCommerce",
    "product": "Package Quantity Discount",
    "versions": [
      {
        "version": "*",
        "status": "affected",
        "lessThan": "1.2.0",
        "versionType": "semver"
      }
    ],
    "defaultStatus": "unaffected"
  },
  {
    "vendor": "XforWooCommerce",
    "product": "Share, Print and PDF Products for WooCommerce",
    "versions": [
      {
        "version": "*",
        "status": "affected",
        "lessThan": "2.8.0",
        "versionType": "semver"
      }
    ],
    "defaultStatus": "unaffected"
  },
  {
    "vendor": "XforWooCommerce",
    "product": "Bulk Add to Cart for WooCommerce",
    "versions": [
      {
        "version": "*",
        "status": "affected",
        "lessThan": "1.3.0",
        "versionType": "semver"
      }
    ],
    "defaultStatus": "unaffected"
  },
  {
    "vendor": "XforWooCommerce",
    "product": "Live Search for WooCommerce",
    "versions": [
      {
        "version": "*",
        "status": "affected",
        "lessThan": "2.1.0",
        "versionType": "semver"
      }
    ],
    "defaultStatus": "unaffected"
  },
  {
    "vendor": "XforWooCommerce",
    "product": "Floating Cart for WooCommerce",
    "versions": [
      {
        "version": "*",
        "status": "affected",
        "lessThan": "1.3.0",
        "versionType": "semver"
      }
    ],
    "defaultStatus": "unaffected"
  },
  {
    "vendor": "XforWooCommerce",
    "product": "Add Product Tabs for WooCommerce",
    "versions": [
      {
        "version": "*",
        "status": "affected",
        "lessThan": "1.5.0",
        "versionType": "semver"
      }
    ],
    "defaultStatus": "unaffected"
  },
  {
    "vendor": "XforWooCommerce",
    "product": "Product Loops for WooCommerce",
    "versions": [
      {
        "version": "*",
        "status": "affected",
        "lessThan": "1.7.0",
        "versionType": "semver"
      }
    ],
    "defaultStatus": "unaffected"
  },
  {
    "vendor": "XforWooCommerce",
    "product": "Autopilot SEO for WooCommerce",
    "versions": [
      {
        "version": "*",
        "status": "affected",
        "lessThan": "1.6.0",
        "versionType": "semver"
      }
    ],
    "defaultStatus": "unaffected"
  }
]

References

blog.nintechnet.com/16-woocommerce-product-add-ons-plugins-fixed-vulnerabilities/

www.wordfence.com/threat-intel/vulnerabilities/id/05481984-7c18-4ec7-8d7c-831809c3e86b?source=cve

xforwoocommerce.com/blog/change-log/xforwoocommerce-1-7-0/

8.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

8.2 High

AI Score

Confidence

High

0.002 Low

EPSS

Percentile

54.3%

JSON

Related for CVE-2021-4337

prion1 nvd1 cvelist1