Product Feed PRO for WooCommerce, a672af3718203bfe2891b97dacbf7dbc502d6cfe

CVE, Research URL: a672af3718203bfe2891b97dacbf7dbc502d6cfe
Home page URL: Security reports for Product Feed PRO for WooCommerce
Application: Product Feed PRO for WooCommerce
Published on: Apr 05, 2023
Research Description: Product Feed PRO for WooCommerce by AdTribes – Product Feeds for WooCommerce [woo-product-feed-pro] < 12.4.5 Product Feed PRO for WooCommerce <= 12.4.4 - Cross-Site Request Forgery The Product Feed PRO for WooCommerce plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 12.4.0. This is due to missing or incorrect nonce validation on several functions such as woosea_enable_structured_data, woosea_structured_vat, woosea_add_manipulation, woosea_add_aelia, and more. This makes it possible for unauthenticated attackers to modify several plugin options and settings, via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Affected versions: max 12.4.5.
Status: vulnerable