Threat Investigation
Request a demo

CVE-2023-3508

Medium

Description

The WooCommerce Pre-Orders WordPress plugin before 2.0.3 has a flawed CSRF check when processing its tab actions, which could allow attackers to make logged in admins email pre-orders customer, change the released date, mark all pre-orders of a specific product as complete or cancel via CSRF attacks

SeverityMedium
CVSS6.5
Exploit probability—
ProductWoocommerce Pre-orders
PublishedJul 31, 2023
First seenJul 31, 2023
Weakness typeCWE-352Cross-site request forgery (CSRF)

How to fix

Update
  • woocommerce woocommerce_pre-orders2.0.3 or later

Affected products

ProductAffected versionsFixed in
woocommerce woocommerce_pre-ordersv < 2.0.32.0.3

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.