CVE-2022-3154

CVE-2022-3154: Multiple Plugins from Viszt Peter - Multiple CSRF

Vendor Todo

Product Woo Billingo Plus

Weakness CWE-352 · CSRF

Published October 10, 2022

Last update August 3, 2024

View on NVD All CVEs

CVSS base score

—

What the vulnerability does

01Description

The Woo Billingo Plus WordPress plugin before 4.4.5.4, Integration for Billingo & Gravity Forms WordPress plugin before 1.0.4, Integration for Szamlazz.hu & Gravity Forms WordPress plugin before 1.2.7 are lacking CSRF checks in various AJAX actions, which could allow attackers to make logged in Shop Managers and above perform unwanted actions, such as deactivate the plugin's license

Key dates

02Disclosure timeline

October 10, 2022 CVE published

August 3, 2024 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2022-3154 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/352.html

Related vulnerabilities

Identifiers

CVE CVE-2022-3154

CWE CWE-352

Affected versions

Vendor Todo

Product Woo Billingo Plus

Affected ≥ 4.4.5.4 and < 4.4.5.4

Vendor Todo

Product Integration for Billingo & Gravity Forms

Affected ≥ 1.0.4 and < 1.0.4

Vendor Todo

Product Integration for Szamlazz.hu & Gravity Forms

Affected ≥ 1.2.7 and < 1.2.7

CVE-2022-3154: Multiple Plugins from Viszt Peter - Multiple CSRF

01Description

02Disclosure timeline

03References

04Related CVE