Skip to content
CVE PROGRAM SOURCE RECORD4.3 Medium

CVE-2022-3451

Product Stock Manager < 1.0.5 - Subscriber+ Unauthorised AJAX Calls

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
WPScan

Description

The Product Stock Manager WordPress plugin before 1.0.5 does not have authorisation and proper CSRF checks in multiple AJAX actions, allowing users with a role as low as subscriber to call them. One action in particular could allow to update arbitrary options

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Unknown Product Stock Manager

  • 1.0.5 to < 1.0.5affected

References