CVE-2019-16251: Medium severity YITHEMES Yith Woocommerce Wishlist Wordpress vulnerability
Published Oct 31, 2019
·Updated
plugin-fw/lib/yit-plugin-panel-wc.php in the YIT Plugin Framework through 3.3.8 for WordPress allows authenticated options changes.
Affected Software
38 affected components
YITHEMES Yith Woocommerce Wishlist Wordpress<=2.2.13
YITHEMES Yith Woocommerce Compare Wordpress<=2.3.13
YITHEMES Yith Woocommerce Quick View Wordpress<=1.3.13
YITHEMES Yith Woocommerce Zoom Magnifier Wordpress<=1.3.11
YITHEMES Yith Woocommerce Ajax Search Wordpress<=1.6.9
YITHEMES Yith Woocommerce Badge Management Wordpress<=1.3.19
YITHEMES Yith Woocommerce Brands Add-on Wordpress<=1.3.6
YITHEMES Yith Woocommerce Request A Quote Wordpress<=1.4.7
YITHEMES Yith Woocommerce Social Login Wordpress<=1.3.4
YITHEMES Yith Woocommerce Order Tracking Wordpress<=1.2.10
YITHEMES Yith Woocommerce Pdf Invoice And Shipping List Wordpress<=1.2.12
YITHEMES Yith Pre-order For Woocommerce Wordpress<=1.1.9
YITHEMES Yith Woocommerce Advanced Reviews Wordpress<=1.3.9
YITHEMES Yith Woocommerce Product Add-ons Wordpress<=1.5.21
YITHEMES Yith Woocommerce Gift Cards Wordpress<=1.3.7
YITHEMES Yith Woocommerce Subscription Wordpress<=1.3.4
YITHEMES Yith Woocommerce Affiliates Wordpress<=1.6.3
YITHEMES Yith Woocommerce Cart Messages Wordpress<=1.4.3
YITHEMES Yith Woocommerce Product Bundles Wordpress<=1.1.15
YITHEMES Yith Woocommerce Frequently Bought Together Wordpress<=1.2.10
YITHEMES Yith Woocommerce Multi-step Checkout Wordpress<=1.7.4
YITHEMES Yith Color And Label Variations For Woocommerce Wordpress<=1.8.11
YITHEMES Yith Custom Thank You Page For Woocommerce Wordpress<=1.1.6
YITHEMES Yith Product Size Charts For Woocommerce Wordpress<=1.1.1
YITHEMES Yith Woocommerce Added To Cart Popup Wordpress<=1.3.11
YITHEMES Yith Woocommerce Bulk Product Editing Wordpress<=1.2.13
YITHEMES Yith Woocommerce Stripe Wordpress<=2.0.1
YITHEMES Yith Woocommerce Waiting List Wordpress<=1.3.9
YITHEMES Yith Woocommerce Points And Rewards Wordpress<=1.3.4
YITHEMES Yith Advanced Refund System For Woocommerce Wordpress<=1.0.10
YITHEMES Yith Woocommerce Authorize.net Payment Gateway Wordpress<=1.1.12
YITHEMES Yith Woocommerce Best Sellers Wordpress<=1.1.11
YITHEMES Yith Woocommerce Mailchimp Wordpress<=2.1.3
YITHEMES Yith Woocommerce Multi Vendor Wordpress<=3.4.0
YITHEMES Yith Woocommerce Questions And Answers Wordpress<=1.1.9
YITHEMES Yith Woocommerce Recover Abandoned Cart Wordpress<=1.3.2
YITHEMES Yith Paypal Express Checkout For Woocommerce Wordpress<=1.2.5
YITHEMES Yith Desktop Notifications For Woocommerce Wordpress<=1.2.7
Event History
Oct 31, 2019
CVE Published
via MITRE·04:09 PM
Data Sourced
via MITRE·04:09 PM
Description
Frequently Asked Questions
1
What is CVE-2019-16251?
CVE-2019-16251 is a vulnerability in the YIT Plugin Framework for WordPress that allows authenticated users to change options.
2
What is the severity of CVE-2019-16251?
The severity of CVE-2019-16251 is medium with a CVSS 3.0 score of 4.3.
3
Which versions of Yith Woocommerce Wishlist are affected by CVE-2019-16251?
Yith Woocommerce Wishlist versions up to and including 2.2.13 are affected by CVE-2019-16251.
4
How can I fix CVE-2019-16251?
To fix CVE-2019-16251, you should update the YIT Plugin Framework to version 3.3.9 or later.
5
Where can I find more information about CVE-2019-16251?
You can find more information about CVE-2019-16251 on the Nintechnet blog and WPScan Vulnerability Database.