WooCommerce Cart Abandonment Recovery, CVE-2024-2322

CVE, Research URL: CVE-2024-2322
Home page URL: Security reports for WooCommerce Cart Abandonment Recovery
Application: WooCommerce Cart Abandonment Recovery
Published on: Apr 03, 2024
Research Description: The WooCommerce Cart Abandonment Recovery WordPress plugin before 1.2.27 does not have CSRF check in its bulk actions, which could allow attackers to make logged in admins delete arbitrary email templates as well as delete and unsubscribe users from abandoned orders via CSRF attacks.
Affected versions: max 1.2.27.
Status: vulnerable