Conditional Shipping for WooCommerce, 80e91b2d1641afe97edd2816ac7a5659ebcba5d2

CVE, Research URL: 80e91b2d1641afe97edd2816ac7a5659ebcba5d2
Home page URL: Security reports for Conditional Shipping for WooCommerce
Application: Conditional Shipping for WooCommerce
Published on: Dec 12, 2022
Research Description: Conditional Shipping for WooCommerce [conditional-shipping-for-woocommerce] < 2.3.2 Conditional Shipping for WooCommerce <= 2.3.1 - Cross-Site Request Forgery The Conditional Shipping for WooCommerce plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.3.1. This is due to missing or incorrect nonce validation on the toggle_ruleset function. This makes it possible for unauthenticated attackers to invoke this function, via forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Affected versions: Min -, max 2.3.2.
Status: vulnerable