Strix
26.1K

CVE-2021-4337

HIGHCVSS 8.8/10EPSS 1.29%

Last modified

CVE-2021-4337 is a high-severity vulnerability rated 8.8/10 on the CVSS scale. Sixteen XforWooCommerce Add-On Plugins for WordPress are vulnerable to authorization bypass due to a missing capability check on the wp_ajax_svx_ajax_factory function in various versions listed below. This makes it possible for authenticated attackers, with subscriber-level permissions and above, to read, edit, or delete WordPress settings, plugin settings, and to arbitrarily list all users on a WordPress website. EPSS estimates a 1.29% chance of exploitation in the next 30 days.

Description

Sixteen XforWooCommerce Add-On Plugins for WordPress are vulnerable to authorization bypass due to a missing capability check on the wp_ajax_svx_ajax_factory function in various versions listed below. This makes it possible for authenticated attackers, with subscriber-level permissions and above, to read, edit, or delete WordPress settings, plugin settings, and to arbitrarily list all users on a WordPress website. The plugins impacted are: Product Filter for WooCommerce < 8.2.0, Improved Product Options for WooCommerce < 5.3.0, Improved Sale Badges for WooCommerce < 4.4.0, Share, Print and PDF Products for WooCommerce < 2.8.0, Product Loops for WooCommerce < 1.7.0, XforWooCommerce < 1.7.0, Package Quantity Discount < 1.2.0, Price Commander for WooCommerce < 1.3.0, Comment and Review Spam Control for WooCommerce < 1.5.0, Add Product Tabs for WooCommerce < 1.5.0, Autopilot SEO for WooCommerce < 1.6.0, Floating Cart < 1.3.0, Live Search for WooCommerce < 2.1.0, Bulk Add to Cart for WooCommerce < 1.3.0, Live Product Editor for WooCommerce < 4.7.0, and Warranties and Returns for WooCommerce < 5.3.0.

Metrics

CVSS 3.1
8.8/10

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS Probability
1.29%

66.5th percentile

Probability of exploitation in the next 30 days. Learn more

Weakness Enumeration

Affected Software

VendorProductVersions
XforwoocommerceAdd Product Tabs< 1.5.0
XforwoocommerceAutopilot Seo< 1.6.0
XforwoocommerceBulk Add To Cart< 1.3.0
XforwoocommerceComment And Review Spam Control< 1.5.0
XforwoocommerceFloating Cart< 1.3.0
XforwoocommerceImproved Product Options< 5.3.0
XforwoocommerceImproved Sale Badges< 4.4.0
XforwoocommerceLive Product Editor< 4.7.0
XforwoocommerceLive Search< 2.1.0
XforwoocommercePackage Quantity< 1.2.0
XforwoocommercePrice Commander< 1.3.0
XforwoocommerceProduct Filter< 8.2.0
XforwoocommerceProduct Loops< 1.7.0
XforwoocommerceShare\, Print And Pdf Products< 2.8.0
XforwoocommerceWarranties And Returns< 5.3.0
XforwoocommerceXforwoocommerce< 1.7.0

References

Timeline

Published
Last Modified
Status
Modified

Frequently Asked Questions

What is CVE-2021-4337?
Sixteen XforWooCommerce Add-On Plugins for WordPress are vulnerable to authorization bypass due to a missing capability check on the wp_ajax_svx_ajax_factory function in various versions listed below. This makes it possible for authenticated attackers, with subscriber-level permissions and above, to read, edit, or delete WordPress settings, plugin settings, and to arbitrarily list all users on a WordPress website. The plugins impacted are: Product Filter for WooCommerce < 8.2.0, Improved Product Options for WooCommerce < 5.3.0, Improved Sale Badges for WooCommerce < 4.4.0, Share, Print and PDF Products for WooCommerce < 2.8.0, Product Loops for WooCommerce < 1.7.0, XforWooCommerce < 1.7.0, Package Quantity Discount < 1.2.0, Price Commander for WooCommerce < 1.3.0, Comment and Review Spam Control for WooCommerce < 1.5.0, Add Product Tabs for WooCommerce < 1.5.0, Autopilot SEO for WooCommerce < 1.6.0, Floating Cart < 1.3.0, Live Search for WooCommerce < 2.1.0, Bulk Add to Cart for WooCommerce < 1.3.0, Live Product Editor for WooCommerce < 4.7.0, and Warranties and Returns for WooCommerce < 5.3.0.
How severe is CVE-2021-4337?
CVE-2021-4337 has a CVSS score of 8.8/10 (HIGH severity). The EPSS model estimates a 1.29% probability of exploitation in the next 30 days.
How do I fix CVE-2021-4337?
Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

Are you affected by CVE-2021-4337?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST