CVE-2023-51678 MEDIUM

CVE-2023-51678: WordPress Doofinder for WooCommerce Plugin <= 2.0.33 is vulnerable to Broken Access Control

Vendor Doofinder
Product Doofinder WP & WooCommerce Search
Weakness CWE-352 · CSRF
Published January 5, 2024
Last update April 28, 2026
View on NVD All CVEs

CVSS base score

4.3/10
Attack vector Network
Attack complexity Low
Privileges required Low
User interaction None
Confidentiality None
Integrity None

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L

What the vulnerability does

01Description

Cross-Site Request Forgery (CSRF) vulnerability in Doofinder Doofinder WP & WooCommerce Search.This issue affects Doofinder WP & WooCommerce Search: from n/a through 2.0.33.

Explanation of Vulnerability in Simple Terms

02Summary

The Doofinder WP & WooCommerce Search plugin through version 2.0.33 is vulnerable to cross-site request forgery (CSRF). An authenticated attacker can perform unwanted actions on behalf of a logged-in user without their knowledge. The vulnerability requires the victim to be logged in but does not require user interaction beyond normal site usage. This can lead to unauthorized changes to site settings or data.

What an attacker can do

03Attacker Capabilities

Perform unauthorized actions on the site on behalf of a logged-in user without their consent.

Potential impact on your site

04Site Impact

An authenticated user's account can be used to make unwanted changes to site configuration or data without their knowledge.

Conditions required to exploit

05Prerequisites

Attacker must be authenticated with low-level privileges; victim must be logged in to the site.

Key dates

06Disclosure timeline

January 5, 2024 CVE published
April 28, 2026 Record updated

Related vulnerabilities

08Related CVE

CVE-2026-8906 WP Promoter <= 1.3 - Cross-Site Request Forgery to Stored Cross-Site Scripting via 'popup_width' Parameter CVE-2026-9618 PeachPay <= 1.120.46 - Cross-Site Request Forgery to Stripe Unlink CVE-2026-8904 FastPicker, an order picker and order management system (oms) for WooCommerce on steroids <= 1.0.2 - Cross-Site Request Forgery via Settings Save CVE-2026-8708 Genzel breadcrumbs <= 1.2 - Cross-Site Request Forgery to Settings Update via Plugin Settings Page CVE-2026-8941 CDN Linker lite <= 1.3.1 - Cross-Site Request Forgery to Plugin Settings Update