CVE-2022-0215: XootiX Plugins <= Various Versions Cross-Site Request Forgery to Arbitrary Options Update
The Login/Signup Popup, Waitlist Woocommerce ( Back in stock notifier ), and Side Cart Woocommerce (Ajax) WordPress plugins by XootiX are vulnerable to Cross-Site Request Forgery via the savesettings function found in the ~/includes/xoo-framework/admin/class-xoo-admin-settings.php file which makes it possible for attackers to update arbitrary options on a site that can be used to create an administrative user account and grant full privileged access to a compromised site. This affects versions <= 2.2 in Login/Signup Popup, versions <= 2.5.1 in Waitlist Woocommerce ( Back in stock notifier ), and versions <= 2.0 in Side Cart Woocommerce (Ajax).
Affected Software
Remediation
Information
Event History
Frequently Asked Questions
What is the severity of CVE-2022-0215?
CVE-2022-0215 has a medium severity rating as it allows for Cross-Site Request Forgery in affected WordPress plugins.
Which WordPress plugins are affected by CVE-2022-0215?
CVE-2022-0215 affects the Xootix Login/Signup Popup, Side Cart WooCommerce, and Waitlist WooCommerce plugins.
How do I fix CVE-2022-0215?
To fix CVE-2022-0215, update the affected plugins to their latest versions that address the vulnerability.
What is Cross-Site Request Forgery in the context of CVE-2022-0215?
Cross-Site Request Forgery is an attack that tricks a user's browser into making unwanted requests to a web application where they are authenticated.
What can happen if CVE-2022-0215 is exploited?
If exploited, CVE-2022-0215 can allow an attacker to perform unauthorized actions on behalf of a user in the affected WordPress plugins.