Description

WordPress Plugin Facebook for WooCommerce is prone to a cross-site request forgery vulnerability. Exploiting this issue may allow a remote attacker to perform certain administrative actions and gain unauthorized access to the affected application; other attacks are also possible. WordPress Plugin Facebook for WooCommerce version 1.9.14 is vulnerable; prior versions may also be affected.

Remediation

Update to plugin version 1.9.15 or latest

References

https://www.pluginvulnerabilities.com/2019/06/17/automattic-is-having-woocommerce-install-by-default-an-insecure-plugin-by-facebook/

https://www.pluginvulnerabilities.com/2019/06/19/if-facebooks-handling-of-the-security-of-their-wordpress-plugins-is-any-indication-they-dont-seem-too-concerned-about-security/

https://plugins.svn.wordpress.org/facebook-for-woocommerce/trunk/readme.txt

Related Vulnerabilities

WordPress 'admin-ajax.php' SQL Injection Vulnerability (2.1.3 - 2.1.3)

WordPress Plugin Stop Spammers Security-Block Spam Users, Comments, Forms Cross-Site Scripting (2021.17)

WordPress Plugin WP Review Slider SQL Injection (10.9)

Joomla! Core 3.x.x Race Condition (3.0.0 - 3.8.7)

WordPress Plugin BuddyPress Unspecified Vulnerability (2.6.0)

Severity

High

Classification

CVE-2019-15841 CWE-352 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:L

Tags

Missing Update CSRF