Add to Cart Text Changer and Customize Button, Add Custom Icon < 2.1 - Add to cart Text Update via CSRF

2023-12-0800:00:00

wpscan.com

cross-site request forgery

woocommerce

plugin vulnerability

csrf protection

nonce validation

8.6 High

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

24.1%

JSON

Description The plugin is vulnerable to Cross-Site Request Forgery due to missing or incorrect nonce validation on the wactc_text_form function, allowing unauthenticated attackers to modify the WooCommerce Add to Cart text via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.

CPENameOperatorVersion
eq2.1

CPE	Name	Operator	Version
		eq	2.1

References

patchstack.com/database/vulnerability/woo-add-to-cart-text-change/wordpress-add-to-cart-text-changer-and-customize-button-add-custom-icon-plugin-2-0-cross-site-request-forgery-csrf-vulnerability