Booster for WooCommerce - Checkout Files Deletion via CSRF

2022-10-3100:00:00

wpvulndb

188

woocommerce

checkout

csrf

exploit

file deletion

EPSS

0.001

Percentile

37.9%

JSON

The plugins do not have CSRF check in place when deleting files uploaded at the checkout, allowing attackers to make a logged in shop manager or admin delete them via a CSRF attack

Requirements:
- Enable the "Checkout File Upload" module of the plugin (/wp-admin/admin.php?page=wc-settings&tab=jetpack&wcj-cat=dashboard&section=all_module)

To delete the checkout files from the Order ID 1, Make a logged in shop manager or admin open: https://example.com/wp-admin/?wcj_download_checkout_file_admin_delete_all=1

EPSS

0.001

Percentile

37.9%

JSON

Related for WPEX-ID:7AB15530-8321-487D-97A5-1469B51FCC3F