Product Slider for WooCommerce <= 2.5.6 - Missing Authorization
2022-07-26 00:00
Krzysztof ZającStrategic Overview
StatusPatched in 2.5.7
Affected PluginProduct Slider, Product Carousel and Product Grid Gallery for WooCommerce – WooProduct Slider
Affected Version
<= 2.5.6CVSS5.4Medium
CVE
CVE-2022-2382Vulnerability Overview
The Product Slider for WooCommerce plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on the spwps_reset_ajax and spwps_get_icons functions called via AJAX actions in versions up to, and including, 2.5.6. This makes it possible for authenticated attackers with minimal permissions, such as a subscriber, to reset arbitrary options and retrieve data.
Technical Analysis
REMEDIATION: Update to version 2.5.7, or a newer patched version --- IDENTIFIER: CWE-862 (Missing Authorization) The product does not perform an authorization check when an actor attempts to access a resource or perform an action.
External References
Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C