CVE-2022-2432

MediumCVSS 4.3/10Last modified Jun 17, 2026

Description

The Ecwid Ecommerce Shopping Cart plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 6.10.23. This is due to missing or incorrect nonce validation on the ecwid_update_plugin_params function. This makes it possible for unauthenticated attackers to update plugin options granted they can trick a site administrator into performing an action such as clicking on a link.

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Weakness enumeration

CWE-352

Affected software

Vendor	Product	Versions
ecwid	Ecwid Ecommerce Shopping Cart	>= 6.10.23, <= 6.10.23

References

https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=2755658%40ecwid-shopping-cart%2Ftrunk&old=2754114%40ecwid-shopping-cart%2Ftrunk&sfp_email=&sfph_mail=Patch, Third Party Advisory
https://www.wordfence.com/blog/2022/08/cross-site-request-forgery-vulnerability-patched-in-ecwid-ecommerce-shopping-cart-plugin/Exploit, Third Party Advisory
https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=2755658%40ecwid-shopping-cart%2Ftrunk&old=2754114%40ecwid-shopping-cart%2Ftrunk&sfp_email=&sfph_mail=Patch, Third Party Advisory
https://www.wordfence.com/blog/2022/08/cross-site-request-forgery-vulnerability-patched-in-ecwid-ecommerce-shopping-cart-plugin/Exploit, Third Party Advisory

Timeline

Published: Sep 6, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-243205.9A CWE-295: Improper Certificate Validation vulnerability exists that could allow a Man-in-theMiddle attack when communications between the c CVE-2022-243217.5A CWE-754: Improper Check for Unusual or Exceptional Conditions vulnerability exists that could cause Denial of Service against the Geo SCAD CVE-2022-243225.9A CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability exists that could cause a disruption of com CVE-2022-243235.9A CWE-754: Improper Check for Unusual or Exceptional Conditions vulnerability exists that could cause a disruption of communication between CVE-2022-243249.8A CWE-120: Buffer Copy without Checking Size of Input vulnerability exists that could cause a stack-based buffer overflow potentially leadin CVE-2022-243277.5In JetBrains Hub before 2021.1.13890, integration with JetBrains Account exposed an API key with excessive permissions.CVE-2022-243286.5In JetBrains Hub before 2021.1.13956, an unprivileged user could perform DoS.CVE-2022-243295.3In JetBrains Kotlin before 1.6.0, it was not possible to lock dependencies for Multiplatform Gradle Projects.CVE-2022-24337.5The WordPress Infinite Scroll – Ajax Load More plugin for WordPress is vulnerable to deserialization of untrusted input via the 'alm_repeate CVE-2022-243306.1In JetBrains TeamCity before 2021.2.1, a redirection to an external site was possible.CVE-2022-243319.8In JetBrains TeamCity before 2021.1.4, GitLab authentication impersonation was possible.CVE-2022-243325.3In JetBrains TeamCity before 2021.2, a logout action didn't remove a Remember Me cookie.