CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
What the vulnerability does
Cross-Site Request Forgery (CSRF) vulnerability in ablancodev Woocommerce Role Pricing woocommerce-role-pricing allows Cross Site Request Forgery.This issue affects Woocommerce Role Pricing: from n/a through <= 3.5.6.
Explanation of Vulnerability in Simple Terms
The WooCommerce Role Pricing plugin for WordPress contains a cross-site request forgery (CSRF) vulnerability in versions up to 3.5.6. An attacker can craft a malicious webpage that, when visited by a logged-in site administrator, performs unwanted actions on the site without their knowledge. The vulnerability requires user interaction but does not require authentication to set up the attack.
What an attacker can do
Trick a logged-in admin into performing unwanted actions via a malicious webpage.
Potential impact on your site
Attackers can modify plugin settings or pricing rules if an admin visits a malicious link.
Conditions required to exploit
Admin must visit attacker's webpage while logged into WordPress.
Key dates
External resources
Related vulnerabilities
