CVE-2022-3154
Last modified
CVE-2022-3154 is a high-severity vulnerability rated 7.1/10 on the CVSS scale. The Woo Billingo Plus WordPress plugin before 4.4.5.4, Integration for Billingo & Gravity Forms WordPress plugin before 1.0.4, Integration for Szamlazz.hu & Gravity Forms WordPress plugin before 1.2.7 are lacking CSRF checks in various AJAX actions, which could allow attackers to make logged in Shop Managers and above perform unwanted actions, such as deactivate the plugin's license. EPSS estimates a 0.34% chance of exploitation in the next 30 days.
Description
The Woo Billingo Plus WordPress plugin before 4.4.5.4, Integration for Billingo & Gravity Forms WordPress plugin before 1.0.4, Integration for Szamlazz.hu & Gravity Forms WordPress plugin before 1.2.7 are lacking CSRF checks in various AJAX actions, which could allow attackers to make logged in Shop Managers and above perform unwanted actions, such as deactivate the plugin's license
Metrics
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:L
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Woo Billingo Plus Project | Woo Billingo Plus | < 4.4.5.4 |
| Integration For Billingo \& Gravity Forms Project | Integration For Billingo \& Gravity Forms | < 1.0.4 |
| Integration For Szamlazz.Hu \& Gravity Forms Project | Integration For Szamlazz.Hu \& Gravity Forms | < 1.2.7 |
References
- https://wpscan.com/vulnerability/cda978b2-b31f-495d-8601-0aaa3e4b45cdExploit, Third Party Advisory
- https://wpscan.com/vulnerability/cda978b2-b31f-495d-8601-0aaa3e4b45cdExploit, Third Party Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2022-3154?
How severe is CVE-2022-3154?
How do I fix CVE-2022-3154?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2022
- CVE-2022-31534The echoleegroup/PythonWeb repository through 2018-10-31 on …9.3
- CVE-2022-31535The freefood89/Fishtank repository through 2015-06-24 on Git…9.3
- CVE-2022-31536The jaygarza1982/ytdl-sync repository through 2021-01-02 on …9.3
- CVE-2022-31537The jmcginty15/Solar-system-simulator repository through 202…9.3
- CVE-2022-31538The joaopedro-fg/mp-m08-interface repository through 2020-12…9.3
- CVE-2022-31539The kotekan/kotekan repository through 2021.11 on GitHub all…9.3
- CVE-2022-31540The kumardeepak/hin-eng-preprocessing repository through 201…9.3
- CVE-2022-31541The lyubolp/Barry-Voice-Assistant repository through 2021-01…9.3
- CVE-2022-31542The mandoku/mdweb repository through 2015-05-07 on GitHub al…9.3
- CVE-2022-31543The maxtortime/SetupBox repository through 1.0 on GitHub all…9.3
- CVE-2022-31544The meerstein/rbtm repository through 1.5 on GitHub allows a…9.3
- CVE-2022-31545The ml-inory/ModelConverter repository through 2021-04-26 on…9.3
Are you affected by CVE-2022-3154?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST