QID 150459

Date Published: 2022-01-27

QID 150459: WordPress Side Cart Woocommerce Plugin: CSRF Vulnerability (CVE-2022-0215)

Side Cart Woocommerce is an WordPress plugin. Allows customer to update and delete items from anywhere on your site.

In the installed version of the WordPress plugin, the "save_settings" function does not check for the "nonce", which could allow cross-site request forgery (CSRF) under some circumstances.

CSRF : Cross-site request forgery is a web security vulnerability that allows an attacker to induce users to perform actions that they do not intend to perform.

Affected Versions:
Side Cart Woocommerce plugins before version 2.1

Successful exploitation of this vulnerability may allow remote attackers to update arbitrary options on a site that can be used to create an administrative user account and grant full privileged access to a compromised site.

CVSS V3 rated as Critical - 8.8 severity.

CVSS V2 rated as High - 6.8 severity.

Solution

Customers are advised to upgrade to a fixed version Side Cart Woocommerce 2.1 or later versions to remediate this vulnerability.
Please refer to Wordfence security blog.

Vendor References

Wordfence - www.wordfence.com/blog/2022/01/84000-wordpress-sites-affected-by-three-plugins-with-the-same-vulnerability/

CVEs related to QID 150459

CVE-2022-0215 |

Software Advisories

Advisory ID	Software	Component	Link
Wordfence			www.wordfence.com/blog/2022/01/84000-wordpress-sites-affected-by-three-plugins-with-the-same-vulnerability/

By selecting these links, you may be leaving CVEreport webspace. We have provided these links to other websites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other websites that are more appropriate for your purpose. CVEreport does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, CVEreport does not endorse any commercial products that may be mentioned on these sites. Please address comments about any linked pages to [email protected].