Description

WordPress Plugin Advanced Dynamic Pricing for WooCommerce is prone to multiple vulnerabilities, including security bypass and cross-site request forgery vulnerabilities. Exploiting these issues could allow an attacker to perform otherwise restricted actions and subsequently export pricing ranges, obtain advanced pricing info, make changes to advanced pricing rules, or to perform certain administrative actions and gain unauthorized access to the affected application. WordPress Plugin Advanced Dynamic Pricing for WooCommerce version 4.1.5 is vulnerable; prior versions may also be affected.

Remediation

Update to plugin version 4.1.6 or latest

References

https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/advanced-dynamic-pricing-for-woocommerce/advanced-dynamic-pricing-for-woocommerce-415-missing-authorization

https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/advanced-dynamic-pricing-for-woocommerce/advanced-dynamic-pricing-for-woocommerce-415-missing-authorization-in-ajaxcalculateseveralproducts-function

https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/advanced-dynamic-pricing-for-woocommerce/advanced-dynamic-pricing-for-woocommerce-415-missing-authorization-in-migratecommontoproductonly-function

https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/advanced-dynamic-pricing-for-woocommerce/advanced-dynamic-pricing-for-woocommerce-415-cross-site-request-forgery-2

https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/advanced-dynamic-pricing-for-woocommerce/advanced-dynamic-pricing-for-woocommerce-415-cross-site-request-forgery

https://plugins.svn.wordpress.org/advanced-dynamic-pricing-for-woocommerce/trunk/readme.txt

Related Vulnerabilities

WordPress Plugin Ultimate Profile Builder By CMSHelpLive Multiple Vulnerabilities (2.3.3)

Atlassian Jira CVE-2019-20898 Vulnerability (CVE-2019-20898)

WordPress Plugin WordPress Download Manager Remote Code Execution (2.7.4)

WordPress Plugin DMSGuestbook File Manipulation (1.17.4)

Apache read beyond bounds via ap_rwrite() Vulnerability (CVE-2022-28614)

Severity

High

Classification

CVE-2022-40203 CVE-2022-43488 CVE-2022-43491 CWE-352 CWE-862 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Tags

Missing Update