Description

WordPress Plugin Advanced Dynamic Pricing for WooCommerce is prone to multiple vulnerabilities, including security bypass and cross-site request forgery vulnerabilities. Exploiting these issues could allow an attacker to perform otherwise restricted actions and subsequently export pricing ranges, obtain advanced pricing info, make changes to advanced pricing rules, or to perform certain administrative actions and gain unauthorized access to the affected application. WordPress Plugin Advanced Dynamic Pricing for WooCommerce version 4.1.5 is vulnerable; prior versions may also be affected.

Remediation

Update to plugin version 4.1.6 or latest

References

https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/advanced-dynamic-pricing-for-woocommerce/advanced-dynamic-pricing-for-woocommerce-415-missing-authorization

https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/advanced-dynamic-pricing-for-woocommerce/advanced-dynamic-pricing-for-woocommerce-415-missing-authorization-in-ajaxcalculateseveralproducts-function

https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/advanced-dynamic-pricing-for-woocommerce/advanced-dynamic-pricing-for-woocommerce-415-missing-authorization-in-migratecommontoproductonly-function

https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/advanced-dynamic-pricing-for-woocommerce/advanced-dynamic-pricing-for-woocommerce-415-cross-site-request-forgery-2

https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/advanced-dynamic-pricing-for-woocommerce/advanced-dynamic-pricing-for-woocommerce-415-cross-site-request-forgery

https://plugins.svn.wordpress.org/advanced-dynamic-pricing-for-woocommerce/trunk/readme.txt

Related Vulnerabilities

MySQL CVE-2016-0667 Vulnerability (CVE-2016-0667)

WordPress Plugin Nextend Google Connect Unspecified Vulnerability (1.5.3)

WordPress Plugin Breezing Forms Cross-Site Scripting (1.2.7.33)

WordPress Plugin Frontend File Manager Multiple Vulnerabilities (21.2)

Apache HTTP Server CVE-2013-5704 Vulnerability (CVE-2013-5704)

Severity

High

Classification

CVE-2022-40203 CVE-2022-43488 CVE-2022-43491 CWE-352 CWE-862 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Tags

Missing Update