CVE-2022-3154
High
Description
The Woo Billingo Plus WordPress plugin before 4.4.5.4, Integration for Billingo & Gravity Forms WordPress plugin before 1.0.4, Integration for Szamlazz.hu & Gravity Forms WordPress plugin before 1.2.7 are lacking CSRF checks in various AJAX actions, which could allow attackers to make logged in Shop Managers and above perform unwanted actions, such as deactivate the plugin's license
SeverityHigh
CVSS7.1
Exploit probability—
ProductIntegration For Billingo \& Gravity Forms
PublishedOct 10, 2022
First seenOct 10, 2022
Weakness typeCWE-352Cross-site request forgery (CSRF)
How to fix
Update
- integration_for_billingo_\&_gravity_forms_project integration_for_billingo_\&_gravity_forms1.0.4 or later
- woo_billingo_plus_project woo_billingo_plus4.4.5.4 or later
- integration_for_szamlazz.hu_\&_gravity_forms_project integration_for_szamlazz.hu_\&_gravity_forms1.2.7 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| integration_for_billingo_\&_gravity_forms_project integration_for_billingo_\&_gravity_forms | v < 1.0.4 | 1.0.4 |
| woo_billingo_plus_project woo_billingo_plus | v < 4.4.5.4 | 4.4.5.4 |
| integration_for_szamlazz.hu_\&_gravity_forms_project integration_for_szamlazz.hu_\&_gravity_forms | v < 1.2.7 | 1.2.7 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.