Lucene search

WordfenceCVE-2022-4935

HistoryApr 05, 2023 - 6:15 p.m.

CVE-2022-4935

2023-04-0518:15:07

CWE-862

Wordfence

web.nvd.nist.gov

cve-2022-4935

wordpress

wcfm marketplace

unauthorized access

data modification

ajax actions

security vulnerability

privilege escalation

nvd

CVSS3

8.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

AI Score

8.5

Confidence

High

EPSS

0.001

Percentile

40.3%

JSON

The WCFM Marketplace plugin for WordPress is vulnerable to unauthorized modification and access of data in versions up to, and including, 3.4.11 due to missing capability checks on various AJAX actions. This makes it possible for authenticated attackers, with minimal permissions such as subscribers, to perform a wide variety of actions such as modifying shipping method details, modifying products, deleting arbitrary posts, and privilege escalation (via the wp_ajax_wcfm_vendor_store_online AJAX action).

Affected configurations

Nvd

Vulners

Node

wcloverswcfm_marketplaceRange<3.4.12wordpress

VendorProductVersionCPE
wcloverswcfm_marketplace*cpe:2.3:a:wclovers:wcfm_marketplace:*:*:*:*:*:wordpress:*:*

Vendor	Product	Version	CPE
wclovers	wcfm_marketplace	*	cpe:2.3:a:wclovers:wcfm_marketplace::::::wordpress::*

CNA Affected

[
  {
    "vendor": "wclovers",
    "product": "WCFM Marketplace – Best Multivendor Marketplace for WooCommerce",
    "versions": [
      {
        "version": "*",
        "status": "affected",
        "lessThanOrEqual": "3.4.11",
        "versionType": "semver"
      }
    ],
    "defaultStatus": "unaffected"
  }
]

References

plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2630696%40wc-multivendor-marketplace&new=2630696%40wc-multivendor-marketplace&sfp_email=&sfph_mail=

www.wordfence.com/threat-intel/vulnerabilities/id/85730e9b-c5da-473c-a324-891c5c9f7ba3?source=cve

CVSS3

8.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

AI Score

8.5

Confidence

High

EPSS

0.001

Percentile

40.3%

JSON

Related for CVE-2022-4935