CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
What the vulnerability does
The Kirim.Email WooCommerce Integration plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.2.9. This is due to missing nonce validation on the plugin's settings page. This makes it possible for unauthenticated attackers to modify the plugin's API credentials and integration settings via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Explanation of Vulnerability in Simple Terms
The Kirim.Email WooCommerce Integration plugin through version 1.2.9 is vulnerable to cross-site request forgery (CSRF). An attacker can trick a site administrator into performing unintended actions—such as changing settings or sending emails—by crafting a malicious link or page. The vulnerability requires the admin to visit the attacker's page while logged in to WordPress.
What an attacker can do
Trick an admin into performing unintended actions like changing plugin settings or sending emails without their knowledge.
Potential impact on your site
An attacker could alter email settings, send unauthorized emails, or modify plugin configuration if an admin is tricked into visiting a malicious page.
Conditions required to exploit
Admin must be logged into WordPress and visit a page controlled by the attacker (e.g., click a malicious link).
Key dates
External resources
