CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
What the vulnerability does
The WooCommerce Stock Manager WordPress plugin is vulnerable to Cross-Site Request Forgery leading to Arbitrary File Upload in versions up to, and including, 2.5.7 due to missing nonce and file validation in the /woocommerce-stock-manager/trunk/admin/views/import-export.php file.
Explanation of Vulnerability in Simple Terms
WooCommerce Stock Manager version 2.5.7 is vulnerable to cross-site request forgery (CSRF). An attacker can craft a malicious webpage that, when visited by a logged-in site administrator, performs unauthorized actions on the store without the admin's knowledge or consent. This could allow modification of product stock levels, settings, or other critical store data.
What an attacker can do
Perform unauthorized actions on the store (modify stock, settings, data) by tricking an admin into visiting a malicious page.
Potential impact on your site
An attacker can alter product stock, inventory settings, or other store configuration without your permission or knowledge.
Conditions required to exploit
Site admin must be logged in and visit a page controlled by the attacker (e.g., via phishing link or malicious ad).
Key dates
External resources
Related vulnerabilities
