CVE-2022-3459

MediumCVSS 5.3/10Last modified Jun 17, 2026

Description

The WooCommerce Multiple Free Gift plugin for WordPress is vulnerable to gift manipulation in all versions up to, and including, 1.2.3. This is due to plugin not enforcing server-side checks on the products that can be added as a gift. This makes it possible for unauthenticated attackers to add non-gift items to their cart as a gift.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Weakness enumeration

CWE-639

Affected software

VendorProductVersions
ankitpokhrelWooCommerce Multiple Free Gift<= 1.2.3
lilmonkeewoocommerce_multiple_free_gift<= 1.2.3

References

Timeline

Published
Sep 14, 2024
Last modified
Jun 17, 2026
NVD status
Analyzed

Related CVEs from 2022

CVE-2022-345907.2Hospital Management System v1.0 was discovered to contain a SQL injection vulnerability via the editid parameter in /HMS/admin.php.CVE-2022-345929.8Wavlink WL-WN575A3 RPT75A3.V4300.201217 was discovered to contain a command injection vulnerability via the function obtw. This vulnerabilitCVE-2022-345937.5DPTech VPN v8.1.28.0 was discovered to contain an arbitrary file read vulnerability.CVE-2022-345944.8Advanced School Management System v1.0 was discovered to contain a cross-site scripting (XSS) vulnerability via the component ip/school/moudCVE-2022-345959.8Tenda AX1803 v1.0.0.1_2890 was discovered to contain a command injection vulnerability via the function setipv6status.CVE-2022-345969.8Tenda AX1803 v1.0.0.1_2890 was discovered to contain a command injection vulnerability via the function WanParameterSetting.CVE-2022-345979.8Tenda AX1806 v1.0.0.1 was discovered to contain a command injection vulnerability via the function WanParameterSetting.CVE-2022-345989.8The udpserver in H3C Magic R100 V200R004 and V100R005 has the 9034 port opened, allowing attackers to execute arbitrary commands.CVE-2022-345999.8H3C Magic R200 R200V200R004L02 was discovered to contain a stack overflow via the EdittriggerList interface at /goform/aspForm.CVE-2022-34607.5In affected versions of Octopus Deploy it is possible for certain types of sensitive variables to inadvertently become unmasked when viewed CVE-2022-346009.8H3C Magic R200 R200V200R004L02 was discovered to contain a stack overflow via the EditSTList interface at /goform/aspForm.CVE-2022-346019.8H3C Magic R200 R200V200R004L02 was discovered to contain a stack overflow via the Delstlist interface at /goform/aspForm.
CVE-2022-3459: Medium severity, CVSS 5.3 | Vulnix