CVE-2022-0215: XootiX Plugins <= Various Versions Cross-Site Request Forgery to Arbitrary Options Update
First published: Tue Jan 18 2022(Updated: )
The Login/Signup Popup, Waitlist Woocommerce ( Back in stock notifier ), and Side Cart Woocommerce (Ajax) WordPress plugins by XootiX are vulnerable to Cross-Site Request Forgery via the save_settings function found in the ~/includes/xoo-framework/admin/class-xoo-admin-settings.php file which makes it possible for attackers to update arbitrary options on a site that can be used to create an administrative user account and grant full privileged access to a compromised site. This affects versions <= 2.2 in Login/Signup Popup, versions <= 2.5.1 in Waitlist Woocommerce ( Back in stock notifier ), and versions <= 2.0 in Side Cart Woocommerce (Ajax).
Credit: security@wordfence.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Xootix Login\/signup Popup | <=2.2 | |
| Xootix Side Cart Woocommerce | <=2.0 | |
| Xootix Waitlist Woocommerce Wordpress | <=2.5.1 |
Remedy
Update to the latest versions available for each plugin.
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://plugins.trac.wordpress.org/browser/easy-login-woocommerce/tags/2.2/includes/xoo-framework/admin/class-xoo-admin-settings.php#L122
- https://plugins.trac.wordpress.org/browser/side-cart-woocommerce/tags/2.1/includes/xoo-framework/admin/class-xoo-admin-settings.php?rev=2538194#L128
- https://plugins.trac.wordpress.org/browser/waitlist-woocommerce/tags/2.5.1/includes/xoo-framework/admin/class-xoo-admin-settings.php#L122
- https://wordfence.com/vulnerability-advisories/#CVE-2022-0215
- https://www.wordfence.com/blog/2022/01/84000-wordpress-sites-affected-by-three-plugins-with-the-same-vulnerability/
- agent/type
- collector/nvd-index
- agent/software-canonical-lookup-request
- agent/references
- agent/weakness
- agent/author
- agent/softwarecombine
- agent/description
- collector/mitre-cve
- source/MITRE
- agent/title
- agent/last-modified-date
- agent/remedy
- agent/severity
- agent/tags
- agent/first-publish-date
- agent/event
- vendor/xootix
- canonical/xootix login\/signup popup
- version/xootix login\/signup popup/2.2
- canonical/xootix side cart woocommerce
- version/xootix side cart woocommerce/2.0
- canonical/xootix waitlist woocommerce wordpress
- version/xootix waitlist woocommerce wordpress/2.5.1