CVE-2021-4337: Sixteen XforWooCommerce Add-On Plugins for WordPress are vulnerable to authorization bypass due to a missing capability check on the wp_ajax_svx_ajax_factory function in various versions listed below.

Sixteen XforWooCommerce Add-On Plugins for WordPress are vulnerable to authorization bypass due to a missing capability check on the wp_ajax_svx_ajax_factory function in various versions listed below.

Package

add-product-tabs (WordPress plugin) WordPress

Affected versions

<1.5.0

Fixed in

1.5.0

Severity

high  CVSS 8.8

Exploitation

not on CISA KEV · EPSS 1% (69.8th percentile)

Published

2023-06-07

Source

nvd

References

• https://blog.nintechnet.com/16-woocommerce-product-add-ons-plugins-fixed-vulnerabilities/
• https://www.wordfence.com/threat-intel/vulnerabilities/id/05481984-7c18-4ec7-8d7c-831809c3e86b?source=cve
• https://xforwoocommerce.com/blog/change-log/xforwoocommerce-1-7-0/

Sixteen XforWooCommerce Add-On Plugins for WordPress are vulnerable to authorization bypass due to a missing capability check on the wp_ajax_svx_ajax_factory function in various versions listed below.

Package

autopilot-seo (WordPress plugin) WordPress

Affected versions

<1.6.0

Fixed in

1.6.0

Severity

high  CVSS 8.8

Exploitation

not on CISA KEV · EPSS 1% (69.8th percentile)

Published

2023-06-07

Source

nvd

References

• https://blog.nintechnet.com/16-woocommerce-product-add-ons-plugins-fixed-vulnerabilities/
• https://www.wordfence.com/threat-intel/vulnerabilities/id/05481984-7c18-4ec7-8d7c-831809c3e86b?source=cve
• https://xforwoocommerce.com/blog/change-log/xforwoocommerce-1-7-0/

Sixteen XforWooCommerce Add-On Plugins for WordPress are vulnerable to authorization bypass due to a missing capability check on the wp_ajax_svx_ajax_factory function in various versions listed below.

Package

bulk-add-to-cart (WordPress plugin) WordPress

Affected versions

<1.3.0

Fixed in

1.3.0

Severity

high  CVSS 8.8

Exploitation

not on CISA KEV · EPSS 1% (69.8th percentile)

Published

2023-06-07

Source

nvd

References

• https://blog.nintechnet.com/16-woocommerce-product-add-ons-plugins-fixed-vulnerabilities/
• https://www.wordfence.com/threat-intel/vulnerabilities/id/05481984-7c18-4ec7-8d7c-831809c3e86b?source=cve
• https://xforwoocommerce.com/blog/change-log/xforwoocommerce-1-7-0/

Sixteen XforWooCommerce Add-On Plugins for WordPress are vulnerable to authorization bypass due to a missing capability check on the wp_ajax_svx_ajax_factory function in various versions listed below.

Package

comment-and-review-spam-control (WordPress plugin) WordPress

Affected versions

<1.5.0

Fixed in

1.5.0

Severity

high  CVSS 8.8

Exploitation

not on CISA KEV · EPSS 1% (69.8th percentile)

Published

2023-06-07

Source

nvd

References

• https://blog.nintechnet.com/16-woocommerce-product-add-ons-plugins-fixed-vulnerabilities/
• https://www.wordfence.com/threat-intel/vulnerabilities/id/05481984-7c18-4ec7-8d7c-831809c3e86b?source=cve
• https://xforwoocommerce.com/blog/change-log/xforwoocommerce-1-7-0/

Sixteen XforWooCommerce Add-On Plugins for WordPress are vulnerable to authorization bypass due to a missing capability check on the wp_ajax_svx_ajax_factory function in various versions listed below.

Package

floating-cart (WordPress plugin) WordPress

Affected versions

<1.3.0

Fixed in

1.3.0

Severity

high  CVSS 8.8

Exploitation

not on CISA KEV · EPSS 1% (69.8th percentile)

Published

2023-06-07

Source

nvd

References

• https://blog.nintechnet.com/16-woocommerce-product-add-ons-plugins-fixed-vulnerabilities/
• https://www.wordfence.com/threat-intel/vulnerabilities/id/05481984-7c18-4ec7-8d7c-831809c3e86b?source=cve
• https://xforwoocommerce.com/blog/change-log/xforwoocommerce-1-7-0/

Sixteen XforWooCommerce Add-On Plugins for WordPress are vulnerable to authorization bypass due to a missing capability check on the wp_ajax_svx_ajax_factory function in various versions listed below.

Package

improved-product-options (WordPress plugin) WordPress

Affected versions

<5.3.0

Fixed in

5.3.0

Severity

high  CVSS 8.8

Exploitation

not on CISA KEV · EPSS 1% (69.8th percentile)

Published

2023-06-07

Source

nvd

References

• https://blog.nintechnet.com/16-woocommerce-product-add-ons-plugins-fixed-vulnerabilities/
• https://www.wordfence.com/threat-intel/vulnerabilities/id/05481984-7c18-4ec7-8d7c-831809c3e86b?source=cve
• https://xforwoocommerce.com/blog/change-log/xforwoocommerce-1-7-0/

Sixteen XforWooCommerce Add-On Plugins for WordPress are vulnerable to authorization bypass due to a missing capability check on the wp_ajax_svx_ajax_factory function in various versions listed below.

Package

improved-sale-badges (WordPress plugin) WordPress

Affected versions

<4.4.0

Fixed in

4.4.0

Severity

high  CVSS 8.8

Exploitation

not on CISA KEV · EPSS 1% (69.8th percentile)

Published

2023-06-07

Source

nvd

References

• https://blog.nintechnet.com/16-woocommerce-product-add-ons-plugins-fixed-vulnerabilities/
• https://www.wordfence.com/threat-intel/vulnerabilities/id/05481984-7c18-4ec7-8d7c-831809c3e86b?source=cve
• https://xforwoocommerce.com/blog/change-log/xforwoocommerce-1-7-0/

Sixteen XforWooCommerce Add-On Plugins for WordPress are vulnerable to authorization bypass due to a missing capability check on the wp_ajax_svx_ajax_factory function in various versions listed below.

Package

live-product-editor (WordPress plugin) WordPress

Affected versions

<4.7.0

Fixed in

4.7.0

Severity

high  CVSS 8.8

Exploitation

not on CISA KEV · EPSS 1% (69.8th percentile)

Published

2023-06-07

Source

nvd

References

• https://blog.nintechnet.com/16-woocommerce-product-add-ons-plugins-fixed-vulnerabilities/
• https://www.wordfence.com/threat-intel/vulnerabilities/id/05481984-7c18-4ec7-8d7c-831809c3e86b?source=cve
• https://xforwoocommerce.com/blog/change-log/xforwoocommerce-1-7-0/

Sixteen XforWooCommerce Add-On Plugins for WordPress are vulnerable to authorization bypass due to a missing capability check on the wp_ajax_svx_ajax_factory function in various versions listed below.

Package

live-search (WordPress plugin) WordPress

Affected versions

<2.1.0

Fixed in

2.1.0

Severity

high  CVSS 8.8

Exploitation

not on CISA KEV · EPSS 1% (69.8th percentile)

Published

2023-06-07

Source

nvd

References

• https://blog.nintechnet.com/16-woocommerce-product-add-ons-plugins-fixed-vulnerabilities/
• https://www.wordfence.com/threat-intel/vulnerabilities/id/05481984-7c18-4ec7-8d7c-831809c3e86b?source=cve
• https://xforwoocommerce.com/blog/change-log/xforwoocommerce-1-7-0/

Sixteen XforWooCommerce Add-On Plugins for WordPress are vulnerable to authorization bypass due to a missing capability check on the wp_ajax_svx_ajax_factory function in various versions listed below.

Package

package-quantity (WordPress plugin) WordPress

Affected versions

<1.2.0

Fixed in

1.2.0

Severity

high  CVSS 8.8

Exploitation

not on CISA KEV · EPSS 1% (69.8th percentile)

Published

2023-06-07

Source

nvd

References

• https://blog.nintechnet.com/16-woocommerce-product-add-ons-plugins-fixed-vulnerabilities/
• https://www.wordfence.com/threat-intel/vulnerabilities/id/05481984-7c18-4ec7-8d7c-831809c3e86b?source=cve
• https://xforwoocommerce.com/blog/change-log/xforwoocommerce-1-7-0/

Sixteen XforWooCommerce Add-On Plugins for WordPress are vulnerable to authorization bypass due to a missing capability check on the wp_ajax_svx_ajax_factory function in various versions listed below.

Package

price-commander (WordPress plugin) WordPress

Affected versions

<1.3.0

Fixed in

1.3.0

Severity

high  CVSS 8.8

Exploitation

not on CISA KEV · EPSS 1% (69.8th percentile)

Published

2023-06-07

Source

nvd

References

• https://blog.nintechnet.com/16-woocommerce-product-add-ons-plugins-fixed-vulnerabilities/
• https://www.wordfence.com/threat-intel/vulnerabilities/id/05481984-7c18-4ec7-8d7c-831809c3e86b?source=cve
• https://xforwoocommerce.com/blog/change-log/xforwoocommerce-1-7-0/

Sixteen XforWooCommerce Add-On Plugins for WordPress are vulnerable to authorization bypass due to a missing capability check on the wp_ajax_svx_ajax_factory function in various versions listed below.

Package

product-filter (WordPress plugin) WordPress

Affected versions

<8.2.0

Fixed in

8.2.0

Severity

high  CVSS 8.8

Exploitation

not on CISA KEV · EPSS 1% (69.8th percentile)

Published

2023-06-07

Source

nvd

References

• https://blog.nintechnet.com/16-woocommerce-product-add-ons-plugins-fixed-vulnerabilities/
• https://www.wordfence.com/threat-intel/vulnerabilities/id/05481984-7c18-4ec7-8d7c-831809c3e86b?source=cve
• https://xforwoocommerce.com/blog/change-log/xforwoocommerce-1-7-0/

Sixteen XforWooCommerce Add-On Plugins for WordPress are vulnerable to authorization bypass due to a missing capability check on the wp_ajax_svx_ajax_factory function in various versions listed below.

Package

product-loops (WordPress plugin) WordPress

Affected versions

<1.7.0

Fixed in

1.7.0

Severity

high  CVSS 8.8

Exploitation

not on CISA KEV · EPSS 1% (69.8th percentile)

Published

2023-06-07

Source

nvd

References

• https://blog.nintechnet.com/16-woocommerce-product-add-ons-plugins-fixed-vulnerabilities/
• https://www.wordfence.com/threat-intel/vulnerabilities/id/05481984-7c18-4ec7-8d7c-831809c3e86b?source=cve
• https://xforwoocommerce.com/blog/change-log/xforwoocommerce-1-7-0/

Sixteen XforWooCommerce Add-On Plugins for WordPress are vulnerable to authorization bypass due to a missing capability check on the wp_ajax_svx_ajax_factory function in various versions listed below.

Package

share\,-print-and-pdf-products (WordPress plugin) WordPress

Affected versions

<2.8.0

Fixed in

2.8.0

Severity

high  CVSS 8.8

Exploitation

not on CISA KEV · EPSS 1% (69.8th percentile)

Published

2023-06-07

Source

nvd

References

• https://blog.nintechnet.com/16-woocommerce-product-add-ons-plugins-fixed-vulnerabilities/
• https://www.wordfence.com/threat-intel/vulnerabilities/id/05481984-7c18-4ec7-8d7c-831809c3e86b?source=cve
• https://xforwoocommerce.com/blog/change-log/xforwoocommerce-1-7-0/

Sixteen XforWooCommerce Add-On Plugins for WordPress are vulnerable to authorization bypass due to a missing capability check on the wp_ajax_svx_ajax_factory function in various versions listed below.

Package

warranties-and-returns (WordPress plugin) WordPress

Affected versions

<5.3.0

Fixed in

5.3.0

Severity

high  CVSS 8.8

Exploitation

not on CISA KEV · EPSS 1% (69.8th percentile)

Published

2023-06-07

Source

nvd

References

• https://blog.nintechnet.com/16-woocommerce-product-add-ons-plugins-fixed-vulnerabilities/
• https://www.wordfence.com/threat-intel/vulnerabilities/id/05481984-7c18-4ec7-8d7c-831809c3e86b?source=cve
• https://xforwoocommerce.com/blog/change-log/xforwoocommerce-1-7-0/

Sixteen XforWooCommerce Add-On Plugins for WordPress are vulnerable to authorization bypass due to a missing capability check on the wp_ajax_svx_ajax_factory function in various versions listed below.

Package

xforwoocommerce (WordPress plugin) WordPress

Affected versions

<1.7.0

Fixed in

1.7.0

Severity

high  CVSS 8.8

Exploitation

not on CISA KEV · EPSS 1% (69.8th percentile)

Published

2023-06-07

Source

nvd

References

• https://blog.nintechnet.com/16-woocommerce-product-add-ons-plugins-fixed-vulnerabilities/
• https://www.wordfence.com/threat-intel/vulnerabilities/id/05481984-7c18-4ec7-8d7c-831809c3e86b?source=cve
• https://xforwoocommerce.com/blog/change-log/xforwoocommerce-1-7-0/

Related advisories

• CVE-2022-1329 high The Elementor Website Builder plugin for WordPress is vulnerable to unauthorized execution same weakness: CWE-862
• CVE-2023-6875 critical The POST SMTP Mailer – Email log, Delivery Failure Notifications and Best Mail SMTP for Wo same weakness: CWE-862
• CVE-2020-8772 critical The InfiniteWP Client plugin before 1.9.4.5 for WordPress has a missing authorization chec same weakness: CWE-862
• CVE-2019-19985 medium The WordPress plugin, Email Subscribers & Newsletters, before 4.2.3 had a flaw that allowe same weakness: CWE-862
• CVE-2022-0218 high The WP HTML Mail WordPress plugin is vulnerable to unauthorized access which allows unauth same weakness: CWE-862
• CVE-2024-1380 medium The Relevanssi – A Better Search plugin for WordPress is vulnerable to unauthorized access same weakness: CWE-862