CVE-2022-0775

MediumCVSS 4.3/10Last modified Jun 17, 2026

Description

The WooCommerce WordPress plugin before 6.2.1 does not have proper authorisation check when deleting reviews, which could allow any authenticated users, such as subscriber to delete arbitrary comment

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Weakness enumeration

CWE-863

Affected software

Vendor	Product	Versions
Unknown	WooCommerce	< 6.2.1

References

https://developer.woocommerce.com/2022/02/22/woocommerce-6-2-1-security-fix/Release Notes
https://plugins.trac.wordpress.org/changeset/2683324Patch
https://wpscan.com/vulnerability/b76dbf37-a0a2-48cf-bd85-3ebbc2f394dd/Exploit, Third Party Advisory
https://developer.woocommerce.com/2022/02/22/woocommerce-6-2-1-security-fix/Release Notes
https://plugins.trac.wordpress.org/changeset/2683324Patch
https://wpscan.com/vulnerability/b76dbf37-a0a2-48cf-bd85-3ebbc2f394dd/Exploit, Third Party Advisory

Timeline

Published: Jan 16, 2024
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-07766.1Cross-site Scripting (XSS) - DOM in GitHub repository hakimel/reveal.js prior to 4.3.0.CVE-2022-07777.5Weak Password Recovery Mechanism for Forgotten Password in GitHub repository microweber/microweber prior to 1.3.CVE-2022-07787.5The BN_mod_sqrt() function, which computes a modular square root, contains a bug that can cause it to loop forever for non-prime moduli. Int CVE-2022-07796.5The User Meta WordPress plugin before 2.4.4 does not validate the filepath parameter of its um_show_uploaded_file AJAX action, which could a CVE-2022-07806.1The SearchIQ WordPress plugin before 3.9 contains a flag to disable the verification of CSRF nonces, granting unauthenticated attackers acce CVE-2022-07819.8The Nirweb support WordPress plugin before 2.8.2 does not sanitise and escape a parameter before using it in a SQL statement via an AJAX act CVE-2022-07829.8The Donations WordPress plugin through 1.8 does not sanitise and escape the nd_donations_id parameter before using it in a SQL statement via CVE-2022-07839.8The Multiple Shipping Address Woocommerce WordPress plugin before 2.0 does not properly sanitise and escape numerous parameters before using CVE-2022-07849.8The Title Experiments Free WordPress plugin before 9.0.1 does not sanitise and escape the id parameter before using it in a SQL statement vi CVE-2022-07859.8The Daily Prayer Time WordPress plugin before 2022.03.01 does not sanitise and escape the month parameter before using it in a SQL statement CVE-2022-07869.8The KiviCare WordPress plugin before 2.3.9 does not sanitise and escape some parameters before using them in SQL statements via the ajax_pos CVE-2022-07879.8The Limit Login Attempts (Spam Protection) WordPress plugin before 5.1 does not sanitise and escape some parameters before using them in SQL