Stock Sync for WooCommerce, 23ffa51356546ca775585c4791fa3a9a9049f03b

CVE, Research URL: 23ffa51356546ca775585c4791fa3a9a9049f03b
Home page URL: Security reports for Stock Sync for WooCommerce
Application: Stock Sync for WooCommerce
Published on: Mar 22, 2023
Research Description: Stock Sync for WooCommerce [stock-sync-for-woocommerce] < 2.4.0 Stock Sync for WooCommerce <= 2.3.2 - Cross-Site Request Forgery The Stock Sync for WooCommerce plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.3.2. This is due to missing or incorrect nonce validation on the function push_all, push, update, create_log_table. This makes it possible for unauthenticated attackers to push stock quantities to external sites and create log tables via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Affected versions: max 2.4.0.
Status: vulnerable