CVE-2022-2432 HIGH

CVE-2022-2432: Ecwid Ecommerce Shopping Cart <= 6.10.23 - Cross-Site Request Forgery to Settings/Options Update

Vendor Ecwid
Product Ecwid Ecommerce Shopping Cart
Weakness CWE-352 · CSRF
Published September 6, 2022
Last update January 31, 2025
View on NVD All CVEs

CVSS base score

8.8/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction Required
Confidentiality High
Integrity High

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

What the vulnerability does

01Description

The Ecwid Ecommerce Shopping Cart plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 6.10.23. This is due to missing or incorrect nonce validation on the ecwid_update_plugin_params function. This makes it possible for unauthenticated attackers to update plugin options granted they can trick a site administrator into performing an action such as clicking on a link.

Key dates

02Disclosure timeline

September 6, 2022 CVE published
January 31, 2025 Record updated

Related vulnerabilities

04Related CVE

CVE-2025-23692 WordPress Slider for Writers plugin <= 1.3 - CSRF to Stored XSS vulnerability CVE-2022-38470 WordPress Customer Reviews for WooCommerce plugin <= 5.3.5 - Cross-Site Request Forgery (CSRF) vulnerability CVE-2025-22556 WordPress Norse Rune Oracle plugin <= 1.4.2 - CSRF to Stored XSS vulnerability CVE-2025-39375 WordPress Easy Child Theme Creator plugin <= 1.3.1 - Cross Site Request Forgery (CSRF) vulnerability CVE-2016-20028 ZKTeco ZKBioSecurity 3.0 Cross-Site Request Forgery Superadmin