CVE-2022-3923

MediumCVSS 4.3/10Last modified Jun 17, 2026

Description

The ActiveCampaign for WooCommerce WordPress plugin before 1.9.8 does not have authorisation check when cleaning up its error logs via an AJAX action, which could allow any authenticated users, such as subscriber to call it and remove error logs.

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Weakness enumeration

CWE-862

Affected software

Vendor	Product	Versions
Unknown	ActiveCampaign for WooCommerce	< 1.9.8

References

https://wpscan.com/vulnerability/6536946a-7ebf-4f8f-9446-36ec2a2a3ad2Exploit, Third Party Advisory
https://wpscan.com/vulnerability/6536946a-7ebf-4f8f-9446-36ec2a2a3ad2Exploit, Third Party Advisory

Timeline

Published: Jan 9, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-392306.5fhir-works-on-aws-authz-smart is an implementation of the authorization interface from the FHIR Works interface. Versions 3.1.1 and 3.1.2 ar CVE-2022-392313.7Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. In versions prior to 4.10.16, or fro CVE-2022-392324.3Discourse is an open source discussion platform. Starting with version 2.9.0.beta5 and prior to version 2.9.0.beta10, an incomplete quote ca CVE-2022-392335.4Tuleap is a Free & Open Source Suite to improve management of software developments and collaboration. In versions 12.9.99.228 and above, pr CVE-2022-392348.8GLPI stands for Gestionnaire Libre de Parc Informatique. GLPI is a Free Asset and IT Management Software package that provides ITIL Service CVE-2022-392365.3Matrix Javascript SDK is the Matrix Client-Server SDK for JavaScript. Starting with version 17.1.0-rc.1, improperly formed beacon events can CVE-2022-392379.8syslabs/sif is the Singularity Image Format (SIF) reference implementation. In versions prior to 2.8.1the `github.com/sylabs/sif/v2/pkg/inte CVE-2022-392388.8Arvados is an open source platform for managing and analyzing biomedical big data. In versions prior to 2.4.3, when using Portable Authentic CVE-2022-392395.4netlify-ipx is an on-Demand image optimization for Netlify using ipx. In versions prior to 1.2.3, an attacker can bypass the source image do CVE-2022-39247.5This issue can affect BIND 9 resolvers with `stale-answer-enable yes;` that also make use of the option `stale-answer-client-timeout`, confi CVE-2022-392405.4MyGraph is a permission management system. Versions prior to 1.0.4 are vulnerable to a storage XSS vulnerability leading to Remote Code Exec CVE-2022-392414.9Discourse is a platform for community discussion. A malicious admin could use this vulnerability to perform port enumeration on the local ho