CVE-2022-3946

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

The Welcart e-Commerce WordPress plugin before 2.8.4 does not have authorisation and CSRF in an AJAX action, allowing any logged-in user to create, update and delete shipping methods.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Weakness enumeration

CWE-352CWE-862

Affected software

VendorProductVersions
UnknownWelcart e-Commerce< 2.8.4

References

Timeline

Published
Dec 12, 2022
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2022

CVE-2022-39479.8A vulnerability classified as critical has been found in eolinker goku_lite. This affects an unknown part of the file /balance/service/list.CVE-2022-39489.8A vulnerability classified as critical was found in eolinker goku_lite. This vulnerability affects unknown code of the file /plugin/getList.CVE-2022-39496.1A vulnerability, which was classified as problematic, has been found in Sourcecodester Simple Cashiering System. This issue affects some unkCVE-2022-39506.1A vulnerability, which was classified as problematic, was found in sanluan PublicCMS. Affected is the function initLink of the file dwz.min.CVE-2022-39527.1A vulnerability has been found in ManyDesigns Portofino 5.3.2 and classified as problematic. Affected by this vulnerability is the function CVE-2022-39559.8A vulnerability was found in tholum crm42. It has been rated as critical. This issue affects some unknown processing of the file crm42\classCVE-2022-39569.8A vulnerability classified as critical has been found in tsruban HHIMS 2.1. Affected is an unknown function of the component Patient PortraiCVE-2022-39576.5A vulnerability classified as problematic was found in GPAC. Affected by this vulnerability is the function svg_parse_preserveaspectratio ofCVE-2022-39585.4Cross-site Scripting (XSS) vulnerability in BlueSpiceUserSidebar extension of BlueSpice allows user with regular account and edit permissionCVE-2022-39595.3A vulnerability, which was classified as problematic, has been found in drogon up to 1.8.1. Affected by this issue is some unknown functionaCVE-2022-39606.3Hitachi Vantara Pentaho Business Analytics Server prior to versions 9.4.0.1 and 9.3.0.2, including 8.3.x cannot allow a system administratorCVE-2022-39616.5The Directorist WordPress plugin before 7.4.4 does not prevent users with low privileges (like subscribers) from accessing sensitive system