CVE-2022-2432

The Ecwid Ecommerce Shopping Cart plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 6.10.23. This is due to missing or incorrect nonce validation on the ecwid_update_plugin_params function. This makes it possible for unauthenticated attackers to update plugin options granted they can trick a site administrator into performing an action such as clicking on a link.

• CWE-352
• CWE-352

• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=2755658%40ecwid-shopping-cart%2Ftrunk&old=2754114%40ecwid-shopping-cart%2Ftrunk&sfp_email=&sfph_mail=Patch, Third Party Advisory
• https://www.wordfence.com/blog/2022/08/cross-site-request-forgery-vulnerability-patched-in-ecwid-ecommerce-shopping-cart-plugin/Exploit, Third Party Advisory
• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=2755658%40ecwid-shopping-cart%2Ftrunk&old=2754114%40ecwid-shopping-cart%2Ftrunk&sfp_email=&sfph_mail=Patch, Third Party Advisory
• https://www.wordfence.com/blog/2022/08/cross-site-request-forgery-vulnerability-patched-in-ecwid-ecommerce-shopping-cart-plugin/Exploit, Third Party Advisory

Published

Sep 6, 2022

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-24314A CWE-125: Out-of-bounds Read vulnerability exists that coul…7.5
• CVE-2022-24315A CWE-125: Out-of-bounds Read vulnerability exists that coul…7.5
• CVE-2022-24316A CWE-665: Improper Initialization vulnerability exists that…7.5
• CVE-2022-24317A CWE-862: Missing Authorization vulnerability exists that c…7.5
• CVE-2022-24318A CWE-326: Inadequate Encryption Strength vulnerability exis…7.5
• CVE-2022-24319A CWE-295: Improper Certificate Validation vulnerability exi…5.9
• CVE-2022-24320A CWE-295: Improper Certificate Validation vulnerability exi…5.9
• CVE-2022-24321A CWE-754: Improper Check for Unusual or Exceptional Conditi…7.5
• CVE-2022-24322A CWE-119: Improper Restriction of Operations within the Bou…5.9
• CVE-2022-24323A CWE-754: Improper Check for Unusual or Exceptional Conditi…5.9
• CVE-2022-24324A CWE-120: Buffer Copy without Checking Size of Input vulner…9.8
• CVE-2022-24327In JetBrains Hub before 2021.1.13890, integration with JetBr…7.5