CVE-2022-4426

MediumCVSS 4.3/10Last modified Jun 17, 2026

Description

The Mautic Integration for WooCommerce WordPress plugin before 1.0.3 does not have proper CSRF check when updating settings, and does not ensure that the options to be updated belong to the plugin, allowing attackers to make a logged in admin change arbitrary blog options via a CSRF attack.

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Affected software

No affected versions have been published.

Timeline

Published: Jan 9, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-442608.8TOTOLINK LR350 V9.3.5u.6369_B20220309 contains a post-authentication buffer overflow via parameter sPort/ePort in the setIpPortFilterRules f CVE-2022-442616.1Avery Dennison Monarch Printer M9855 is vulnerable to Cross Site Scripting (XSS).CVE-2022-442629.8ff4j 1.8.1 is vulnerable to Remote Code Execution (RCE).CVE-2022-442637.8Dentsply Sirona Sidexis <= 4.3 is vulnerable to Incorrect Access Control.CVE-2022-442647.8Dentsply Sirona Sidexis <= 4.3 is vulnerable to Unquoted Service Path.CVE-2022-442676.5ImageMagick 7.1.0-49 is vulnerable to Denial of Service. When it parses a PNG image (e.g., for resize), the convert process could be left wa CVE-2022-442686.5ImageMagick 7.1.0-49 is vulnerable to Information Disclosure. When it parses a PNG image (e.g., for resize), the resulting image could have CVE-2022-44279.8Improper Input Validation vulnerability in OTRS AG OTRS, OTRS AG ((OTRS)) Community Edition allows SQL Injection via TicketSearch Webservice CVE-2022-442769.8In Responsive Filemanager < 9.12.0, an attacker can bypass upload restrictions resulting in RCE.CVE-2022-442777.2Sanitization Management System v1.0 is vulnerable to SQL Injection via /php-sms/classes/Master.php?f=delete_product.CVE-2022-442787.2Sanitization Management System v1.0 is vulnerable to SQL Injection via /php-sms/admin/?page=user/manage_user&id=.CVE-2022-442796.1Garage Management System v1.0 is vulnerable to Cross Site Scripting (XSS) via /garage/php_action/createBrand.php.