WordPress security changelog
MEDIUM
CVE-2022-47177
Modified
Wp Easy Pay: Cross-site request forgery
Wp Easy Pay is affected by cross-site request forgery. Exposure depends on how the affected operation is made reachable by the site. Exploitation relies on a signed-in privileged user submitting an attacker-controlled request.
CVE / CNA score
4.3
CVSS 3.1 · audit@patchstack.com
NVD score
8.8
CVSS 3.1 · nvd@nist.gov
- Component
- Wp Easy Pay
- Plugin slug
wp-easy-pay- Affected
- See vendor advisory
- Safe version
- See mitigation notes
- Published
- May 25, 2023
This CVE was published May 25, 2023 and is one of 8 known issues for this plugin.
What to do
Patch or disable the affected component.
Update Wp Easy Pay to a release outside the affected range, or disable and remove it until a fixed version is available.
Source record
Technical description
Cross-Site Request Forgery (CSRF) vulnerability in WP Easy Pay WP EasyPay – Square for WordPress plugin <= 4.1 versions.
CVE / CNA vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L
NVD vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
References