{"id":"CVE-2022-3999","state":"PUBLISHED","title":"WooCommerce Shipping - DPD baltic < 1.2.57 - Subscriber+ Arbitrary Options Deletion","description":"The DPD Baltic Shipping WordPress plugin before 1.2.57 does not have authorisation and CSRF in an AJAX action, which could allow any authenticated users, such as subscriber to delete arbitrary options from the blog, which could make the blog unavailable.","publishedAt":"2022-12-12T17:54:49.698Z","updatedAt":"2025-04-22T14:49:47.210Z","severity":{"score":8.1,"label":"High","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H","source":"CISA-ADP"},"assigner":"WPScan","products":["Unknown DPD Baltic Shipping"],"affected":[{"vendor":"Unknown","product":"DPD Baltic Shipping","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThan":"1.2.57","versionType":"custom"}],"collectionURL":"https://wordpress.org/plugins"}],"references":["https://wpscan.com/vulnerability/625ae924-68db-4579-a34f-e6f33aa33643"],"weaknesses":[],"ingestedAt":"2026-10-29T19:50:32.060Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2022/3xxx/CVE-2022-3999.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.1","cveMetadata":{"cveId":"CVE-2022-3999","state":"PUBLISHED","datePublished":"2022-12-12T17:54:49.698Z","dateUpdated":"2025-04-22T14:49:47.210Z","assignerShortName":"WPScan","assignerOrgId":"1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81","requesterUserId":"dc9e157c-ddf1-4983-adaf-9f01d16b5e04","dateReserved":"2022-11-15T14:56:29.051Z"},"containers":{"cna":{"title":"WooCommerce Shipping - DPD baltic < 1.2.57 - Subscriber+ Arbitrary Options Deletion","descriptions":[{"lang":"en","value":"The DPD Baltic Shipping WordPress plugin before 1.2.57 does not have authorisation and CSRF in an AJAX action, which could allow any authenticated users, such as subscriber to delete arbitrary options from the blog, which could make the blog unavailable."}],"affected":[{"vendor":"Unknown","product":"DPD Baltic Shipping","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThan":"1.2.57","versionType":"custom"}],"collectionURL":"https://wordpress.org/plugins"}],"references":[{"url":"https://wpscan.com/vulnerability/625ae924-68db-4579-a34f-e6f33aa33643","tags":["exploit","vdb-entry","technical-description"]}],"problemTypes":[{"descriptions":[{"description":"CWE-862 Missing Authorization","lang":"en","type":"CWE"}]},{"descriptions":[{"description":"CWE-352 Cross-Site Request Forgery (CSRF)","lang":"en","type":"CWE"}]}],"providerMetadata":{"shortName":"WPScan","orgId":"1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81","dateUpdated":"2023-02-03T13:10:04.883Z"},"credits":[{"lang":"en","value":"Lana Codes","type":"finder"},{"lang":"en","value":"WPScan","type":"coordinator"}],"source":{"discovery":"EXTERNAL"},"x_generator":{"engine":"WPScan CVE Generator"}},"adp":[{"title":"CVE Program Container","references":[{"url":"https://wpscan.com/vulnerability/625ae924-68db-4579-a34f-e6f33aa33643","tags":["exploit","vdb-entry","technical-description","x_transferred"]}],"providerMetadata":{"shortName":"CVE","orgId":"af854a3a-2127-422b-91ae-364da2661108","dateUpdated":"2024-08-03T01:27:54.067Z"}},{"title":"CISA ADP Vulnrichment","metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":8.1,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H","integrityImpact":"HIGH","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"LOW","confidentialityImpact":"NONE"}},{"other":{"type":"ssvc","content":{"timestamp":"2025-04-22T14:48:50.771950Z","id":"CVE-2022-3999","options":[{"Exploitation":"poc"},{"Automatable":"no"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2025-04-22T14:49:47.210Z"}}]}}}