CVE-2022-0775 WooCommerce < 6.2.1 - Subscriber+ Arbitrary Comment Deletion

2024-01-1615:52:36

WPScan

www.cve.org

woocommerce

plugin

comment

deletion

authorization

vulnerability

AI Score

4.9

Confidence

High

EPSS

0.001

Percentile

19.0%

JSON

The WooCommerce WordPress plugin before 6.2.1 does not have proper authorisation check when deleting reviews, which could allow any authenticated users, such as subscriber to delete arbitrary comment

CNA Affected

[
  {
    "vendor": "Unknown",
    "product": "WooCommerce",
    "versions": [
      {
        "status": "affected",
        "versionType": "semver",
        "version": "0",
        "lessThan": "6.2.1"
      }
    ],
    "defaultStatus": "unaffected",
    "collectionURL": "https://wordpress.org/plugins"
  }
]