Vulnerability-Lookup

CVE-2021-4337 (GCVE-0-2021-4337)

Vulnerability from cvelistv5 – Published: 2023-06-07 12:43 – Updated: 2026-04-08 16:33

Title

Multiple XforWooCommerce Add-On Plugins (Various Versions) - Missing Authorization

Summary

Sixteen XforWooCommerce Add-On Plugins for WordPress are vulnerable to authorization bypass due to a missing capability check on the wp_ajax_svx_ajax_factory function in various versions listed below. This makes it possible for authenticated attackers, with subscriber-level permissions and above, to read, edit, or delete WordPress settings, plugin settings, and to arbitrarily list all users on a WordPress website. The plugins impacted are: Product Filter for WooCommerce < 8.2.0, Improved Product Options for WooCommerce < 5.3.0, Improved Sale Badges for WooCommerce < 4.4.0, Share, Print and PDF Products for WooCommerce < 2.8.0, Product Loops for WooCommerce < 1.7.0, XforWooCommerce < 1.7.0, Package Quantity Discount < 1.2.0, Price Commander for WooCommerce < 1.3.0, Comment and Review Spam Control for WooCommerce < 1.5.0, Add Product Tabs for WooCommerce < 1.5.0, Autopilot SEO for WooCommerce < 1.6.0, Floating Cart < 1.3.0, Live Search for WooCommerce < 2.1.0, Bulk Add to Cart for WooCommerce < 1.3.0, Live Product Editor for WooCommerce < 4.7.0, and Warranties and Returns for WooCommerce < 5.3.0.

Severity ?

8.8 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE

CWE-862 - Missing Authorization

Assigner

Wordfence

References

URL

Tags

	https://www.wordfence.com/threat-intel/vulnerabil…
	https://blog.nintechnet.com/16-woocommerce-produc…
	https://xforwoocommerce.com/blog/change-log/xforw…

Impacted products

Vendor

Product

Version

XforWooCommerce

Package Quantity Discount

Affected: 0 , < 1.2.0 (semver)

XforWooCommerce	Price Commander for WooCommerce	Affected: 0 , < 1.3.0 (semver)
XforWooCommerce	Bulk Add to Cart for WooCommerce	Affected: 0 , < 1.3.0 (semver)
XforWooCommerce	Floating Cart for WooCommerce	Affected: 0 , < 1.3.0 (semver)
XforWooCommerce	Comment and Review Spam Control for WooCommerce	Affected: 0 , < 1.5.0 (semver)
XforWooCommerce	Add Product Tabs for WooCommerce	Affected: 0 , < 1.5.0 (semver)
XforWooCommerce	Autopilot SEO for WooCommerce	Affected: 0 , < 1.6.0 (semver)
XforWooCommerce	XforWooCommerce	Affected: 0 , < 1.7.0 (semver)
XforWooCommerce	Product Loops for WooCommerce	Affected: 0 , < 1.7.0 (semver)
XforWooCommerce	Live Search for WooCommerce	Affected: 0 , < 2.1.0 (semver)
XforWooCommerce	Share, Print and PDF Products for WooCommerce	Affected: 0 , < 2.8.0 (semver)
XforWooCommerce	Improved Sale Badges for WooCommerce	Affected: 0 , < 4.4.0 (semver)
XforWooCommerce	Live Product Editor for WooCommerce	Affected: 0 , < 4.7.0 (semver)
XforWooCommerce	Warranties and Returns for WooCommerce	Affected: 0 , < 5.3.0 (semver)
XforWooCommerce	Improved Product Options for WooCommerce	Affected: 0 , < 5.3.0 (semver)
XforWooCommerce	Product Filter for WooCommerce	Affected: 0 , < 8.2.0 (semver)

Credits

Jerome Bruandet

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T17:23:10.474Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/05481984-7c18-4ec7-8d7c-831809c3e86b?source=cve"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://blog.nintechnet.com/16-woocommerce-product-add-ons-plugins-fixed-vulnerabilities/"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://xforwoocommerce.com/blog/change-log/xforwoocommerce-1-7-0/"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2021-4337",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-12-23T16:00:34.189441Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-12-23T16:20:14.700Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Package Quantity Discount",
          "vendor": "XforWooCommerce",
          "versions": [
            {
              "lessThan": "1.2.0",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Price Commander for WooCommerce",
          "vendor": "XforWooCommerce",
          "versions": [
            {
              "lessThan": "1.3.0",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Bulk Add to Cart for WooCommerce",
          "vendor": "XforWooCommerce",
          "versions": [
            {
              "lessThan": "1.3.0",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Floating Cart for WooCommerce",
          "vendor": "XforWooCommerce",
          "versions": [
            {
              "lessThan": "1.3.0",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Comment and Review Spam Control for WooCommerce",
          "vendor": "XforWooCommerce",
          "versions": [
            {
              "lessThan": "1.5.0",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Add Product Tabs for WooCommerce",
          "vendor": "XforWooCommerce",
          "versions": [
            {
              "lessThan": "1.5.0",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Autopilot SEO for WooCommerce",
          "vendor": "XforWooCommerce",
          "versions": [
            {
              "lessThan": "1.6.0",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "XforWooCommerce",
          "vendor": "XforWooCommerce",
          "versions": [
            {
              "lessThan": "1.7.0",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Product Loops for WooCommerce",
          "vendor": "XforWooCommerce",
          "versions": [
            {
              "lessThan": "1.7.0",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Live Search for WooCommerce",
          "vendor": "XforWooCommerce",
          "versions": [
            {
              "lessThan": "2.1.0",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Share, Print and PDF Products for WooCommerce",
          "vendor": "XforWooCommerce",
          "versions": [
            {
              "lessThan": "2.8.0",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Improved Sale Badges for WooCommerce",
          "vendor": "XforWooCommerce",
          "versions": [
            {
              "lessThan": "4.4.0",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Live Product Editor for WooCommerce",
          "vendor": "XforWooCommerce",
          "versions": [
            {
              "lessThan": "4.7.0",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Warranties and Returns for WooCommerce",
          "vendor": "XforWooCommerce",
          "versions": [
            {
              "lessThan": "5.3.0",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Improved Product Options for WooCommerce",
          "vendor": "XforWooCommerce",
          "versions": [
            {
              "lessThan": "5.3.0",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Product Filter for WooCommerce",
          "vendor": "XforWooCommerce",
          "versions": [
            {
              "lessThan": "8.2.0",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Jerome Bruandet"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Sixteen XforWooCommerce Add-On Plugins for WordPress are vulnerable to authorization bypass due to a missing capability check on the wp_ajax_svx_ajax_factory function in various versions listed below. This makes it possible for authenticated attackers, with subscriber-level permissions and above, to read, edit, or delete WordPress settings, plugin settings, and to arbitrarily list all users on a WordPress website. The plugins impacted are: Product Filter for WooCommerce \u003c 8.2.0, Improved Product Options for WooCommerce \u003c 5.3.0, Improved Sale Badges for WooCommerce \u003c 4.4.0, Share, Print and PDF Products for WooCommerce \u003c 2.8.0, Product Loops for WooCommerce \u003c 1.7.0, XforWooCommerce \u003c 1.7.0, Package Quantity Discount \u003c 1.2.0, Price Commander for WooCommerce \u003c 1.3.0, Comment and Review Spam Control for WooCommerce \u003c 1.5.0, Add Product Tabs for WooCommerce \u003c 1.5.0, Autopilot SEO for WooCommerce \u003c 1.6.0, Floating Cart \u003c 1.3.0, Live Search for WooCommerce \u003c 2.1.0, Bulk Add to Cart for WooCommerce \u003c 1.3.0, Live Product Editor for WooCommerce \u003c 4.7.0, and Warranties and Returns for WooCommerce \u003c 5.3.0."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-862",
              "description": "CWE-862 Missing Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-04-08T16:33:21.807Z",
        "orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
        "shortName": "Wordfence"
      },
      "references": [
        {
          "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/05481984-7c18-4ec7-8d7c-831809c3e86b?source=cve"
        },
        {
          "url": "https://blog.nintechnet.com/16-woocommerce-product-add-ons-plugins-fixed-vulnerabilities/"
        },
        {
          "url": "https://xforwoocommerce.com/blog/change-log/xforwoocommerce-1-7-0/"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2021-09-07T00:00:00.000Z",
          "value": "Disclosed"
        }
      ],
      "title": "Multiple XforWooCommerce Add-On Plugins (Various Versions) - Missing Authorization"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
    "assignerShortName": "Wordfence",
    "cveId": "CVE-2021-4337",
    "datePublished": "2023-06-07T12:43:07.139Z",
    "dateReserved": "2023-06-06T12:20:33.347Z",
    "dateUpdated": "2026-04-08T16:33:21.807Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2021-4337",
      "date": "2026-04-17",
      "epss": "0.0019",
      "percentile": "0.40935"
    },
    "fkie_nvd": {
      "configurations": "[{\"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:xforwoocommerce:add_product_tabs:*:*:*:*:*:wordpress:*:*\", \"versionEndExcluding\": \"1.5.0\", \"matchCriteriaId\": \"EF32845C-A082-4218-A2DE-9E70FE404A5B\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:xforwoocommerce:autopilot_seo:*:*:*:*:*:wordpress:*:*\", \"versionEndExcluding\": \"1.6.0\", \"matchCriteriaId\": \"F2F6559F-BF4C-4963-BEBB-8D782606A4C4\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:xforwoocommerce:bulk_add_to_cart:*:*:*:*:*:wordpress:*:*\", \"versionEndExcluding\": \"1.3.0\", \"matchCriteriaId\": \"DA1EFA61-4DFF-4BAF-AD21-0FBEFDFB185B\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:xforwoocommerce:comment_and_review_spam_control:*:*:*:*:*:wordpress:*:*\", \"versionEndExcluding\": \"1.5.0\", \"matchCriteriaId\": \"A062382F-5B88-4ABD-9887-B1852DDD17E5\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:xforwoocommerce:floating_cart:*:*:*:*:*:wordpress:*:*\", \"versionEndExcluding\": \"1.3.0\", \"matchCriteriaId\": \"3CA7CE2F-63FF-4EAA-B3C6-393F43DA9F31\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:xforwoocommerce:improved_product_options:*:*:*:*:*:wordpress:*:*\", \"versionEndExcluding\": \"5.3.0\", \"matchCriteriaId\": \"E1BBD259-8F51-4AF8-BE0A-04BEB2407F62\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:xforwoocommerce:improved_sale_badges:*:*:*:*:*:wordpress:*:*\", \"versionEndExcluding\": \"4.4.0\", \"matchCriteriaId\": \"9C8FFD0C-805D-43FE-AF3E-2EF0EFD0231E\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:xforwoocommerce:live_product_editor:*:*:*:*:*:wordpress:*:*\", \"versionEndExcluding\": \"4.7.0\", \"matchCriteriaId\": \"2579E688-CAB2-4BAC-90A1-FF805A380C2B\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:xforwoocommerce:live_search:*:*:*:*:*:wordpress:*:*\", \"versionEndExcluding\": \"2.1.0\", \"matchCriteriaId\": \"D613DF5D-D003-4B93-81B8-0B58257B334B\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:xforwoocommerce:package_quantity:*:*:*:*:*:wordpress:*:*\", \"versionEndExcluding\": \"1.2.0\", \"matchCriteriaId\": \"B45F34B1-5F06-492E-A257-1ECD3374626A\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:xforwoocommerce:price_commander:*:*:*:*:*:wordpress:*:*\", \"versionEndExcluding\": \"1.3.0\", \"matchCriteriaId\": \"F591A0E8-4B35-4434-9081-C1F50D6F2992\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:xforwoocommerce:product_filter:*:*:*:*:*:wordpress:*:*\", \"versionEndExcluding\": \"8.2.0\", \"matchCriteriaId\": \"7753ADC1-DCDC-43FB-82E1-3504762FAF94\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:xforwoocommerce:product_loops:*:*:*:*:*:wordpress:*:*\", \"versionEndExcluding\": \"1.7.0\", \"matchCriteriaId\": \"B43756CF-DCF1-4BD6-AF3C-C3C564C9E85E\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:xforwoocommerce:share\\\\,_print_and_pdf_products:*:*:*:*:*:wordpress:*:*\", \"versionEndExcluding\": \"2.8.0\", \"matchCriteriaId\": \"A9523695-0B82-469A-8099-AF2E98D77D7B\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:xforwoocommerce:warranties_and_returns:*:*:*:*:*:wordpress:*:*\", \"versionEndExcluding\": \"5.3.0\", \"matchCriteriaId\": \"E1887B1A-86B3-49A3-AF94-86AE04C24DE0\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:xforwoocommerce:xforwoocommerce:*:*:*:*:*:wordpress:*:*\", \"versionEndExcluding\": \"1.7.0\", \"matchCriteriaId\": \"EEE062F3-7EC3-4FBC-A5E9-CCE825C2B36F\"}]}]}]",
      "descriptions": "[{\"lang\": \"en\", \"value\": \"Sixteen XforWooCommerce Add-On Plugins for WordPress are vulnerable to authorization bypass due to a missing capability check on the wp_ajax_svx_ajax_factory function in various versions listed below. This makes it possible for authenticated attackers, with subscriber-level permissions and above, to read, edit, or delete WordPress settings, plugin settings, and to arbitrarily list all users on a WordPress website. The plugins impacted are: Product Filter for WooCommerce \u003c 8.2.0, Improved Product Options for WooCommerce \u003c 5.3.0, Improved Sale Badges for WooCommerce \u003c 4.4.0, Share, Print and PDF Products for WooCommerce \u003c 2.8.0, Product Loops for WooCommerce \u003c 1.7.0, XforWooCommerce \u003c 1.7.0, Package Quantity Discount \u003c 1.2.0, Price Commander for WooCommerce \u003c 1.3.0, Comment and Review Spam Control for WooCommerce \u003c 1.5.0, Add Product Tabs for WooCommerce \u003c 1.5.0, Autopilot SEO for WooCommerce \u003c 1.6.0, Floating Cart \u003c 1.3.0, Live Search for WooCommerce \u003c 2.1.0, Bulk Add to Cart for WooCommerce \u003c 1.3.0, Live Product Editor for WooCommerce \u003c 4.7.0, and Warranties and Returns for WooCommerce \u003c 5.3.0.\"}]",
      "id": "CVE-2021-4337",
      "lastModified": "2024-11-21T06:37:27.070",
      "metrics": "{\"cvssMetricV31\": [{\"source\": \"security@wordfence.com\", \"type\": \"Secondary\", \"cvssData\": {\"version\": \"3.1\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\", \"baseScore\": 8.8, \"baseSeverity\": \"HIGH\", \"attackVector\": \"NETWORK\", \"attackComplexity\": \"LOW\", \"privilegesRequired\": \"LOW\", \"userInteraction\": \"NONE\", \"scope\": \"UNCHANGED\", \"confidentialityImpact\": \"HIGH\", \"integrityImpact\": \"HIGH\", \"availabilityImpact\": \"HIGH\"}, \"exploitabilityScore\": 2.8, \"impactScore\": 5.9}, {\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"cvssData\": {\"version\": \"3.1\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\", \"baseScore\": 8.8, \"baseSeverity\": \"HIGH\", \"attackVector\": \"NETWORK\", \"attackComplexity\": \"LOW\", \"privilegesRequired\": \"LOW\", \"userInteraction\": \"NONE\", \"scope\": \"UNCHANGED\", \"confidentialityImpact\": \"HIGH\", \"integrityImpact\": \"HIGH\", \"availabilityImpact\": \"HIGH\"}, \"exploitabilityScore\": 2.8, \"impactScore\": 5.9}]}",
      "published": "2023-06-07T13:15:09.437",
      "references": "[{\"url\": \"https://blog.nintechnet.com/16-woocommerce-product-add-ons-plugins-fixed-vulnerabilities/\", \"source\": \"security@wordfence.com\", \"tags\": [\"Exploit\", \"Third Party Advisory\"]}, {\"url\": \"https://www.wordfence.com/threat-intel/vulnerabilities/id/05481984-7c18-4ec7-8d7c-831809c3e86b?source=cve\", \"source\": \"security@wordfence.com\", \"tags\": [\"Third Party Advisory\"]}, {\"url\": \"https://xforwoocommerce.com/blog/change-log/xforwoocommerce-1-7-0/\", \"source\": \"security@wordfence.com\", \"tags\": [\"Vendor Advisory\"]}, {\"url\": \"https://blog.nintechnet.com/16-woocommerce-product-add-ons-plugins-fixed-vulnerabilities/\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Exploit\", \"Third Party Advisory\"]}, {\"url\": \"https://www.wordfence.com/threat-intel/vulnerabilities/id/05481984-7c18-4ec7-8d7c-831809c3e86b?source=cve\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Third Party Advisory\"]}, {\"url\": \"https://xforwoocommerce.com/blog/change-log/xforwoocommerce-1-7-0/\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Vendor Advisory\"]}]",
      "sourceIdentifier": "security@wordfence.com",
      "vulnStatus": "Modified",
      "weaknesses": "[{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"description\": [{\"lang\": \"en\", \"value\": \"CWE-862\"}]}]"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2021-4337\",\"sourceIdentifier\":\"security@wordfence.com\",\"published\":\"2023-06-07T13:15:09.437\",\"lastModified\":\"2026-04-08T17:16:37.967\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"Sixteen XforWooCommerce Add-On Plugins for WordPress are vulnerable to authorization bypass due to a missing capability check on the wp_ajax_svx_ajax_factory function in various versions listed below. This makes it possible for authenticated attackers, with subscriber-level permissions and above, to read, edit, or delete WordPress settings, plugin settings, and to arbitrarily list all users on a WordPress website. The plugins impacted are: Product Filter for WooCommerce \u003c 8.2.0, Improved Product Options for WooCommerce \u003c 5.3.0, Improved Sale Badges for WooCommerce \u003c 4.4.0, Share, Print and PDF Products for WooCommerce \u003c 2.8.0, Product Loops for WooCommerce \u003c 1.7.0, XforWooCommerce \u003c 1.7.0, Package Quantity Discount \u003c 1.2.0, Price Commander for WooCommerce \u003c 1.3.0, Comment and Review Spam Control for WooCommerce \u003c 1.5.0, Add Product Tabs for WooCommerce \u003c 1.5.0, Autopilot SEO for WooCommerce \u003c 1.6.0, Floating Cart \u003c 1.3.0, Live Search for WooCommerce \u003c 2.1.0, Bulk Add to Cart for WooCommerce \u003c 1.3.0, Live Product Editor for WooCommerce \u003c 4.7.0, and Warranties and Returns for WooCommerce \u003c 5.3.0.\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"security@wordfence.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":8.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":2.8,\"impactScore\":5.9},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":8.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":2.8,\"impactScore\":5.9}]},\"weaknesses\":[{\"source\":\"security@wordfence.com\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-862\"}]},{\"source\":\"nvd@nist.gov\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-862\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:xforwoocommerce:add_product_tabs:*:*:*:*:*:wordpress:*:*\",\"versionEndExcluding\":\"1.5.0\",\"matchCriteriaId\":\"EF32845C-A082-4218-A2DE-9E70FE404A5B\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:xforwoocommerce:autopilot_seo:*:*:*:*:*:wordpress:*:*\",\"versionEndExcluding\":\"1.6.0\",\"matchCriteriaId\":\"F2F6559F-BF4C-4963-BEBB-8D782606A4C4\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:xforwoocommerce:bulk_add_to_cart:*:*:*:*:*:wordpress:*:*\",\"versionEndExcluding\":\"1.3.0\",\"matchCriteriaId\":\"DA1EFA61-4DFF-4BAF-AD21-0FBEFDFB185B\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:xforwoocommerce:comment_and_review_spam_control:*:*:*:*:*:wordpress:*:*\",\"versionEndExcluding\":\"1.5.0\",\"matchCriteriaId\":\"A062382F-5B88-4ABD-9887-B1852DDD17E5\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:xforwoocommerce:floating_cart:*:*:*:*:*:wordpress:*:*\",\"versionEndExcluding\":\"1.3.0\",\"matchCriteriaId\":\"3CA7CE2F-63FF-4EAA-B3C6-393F43DA9F31\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:xforwoocommerce:improved_product_options:*:*:*:*:*:wordpress:*:*\",\"versionEndExcluding\":\"5.3.0\",\"matchCriteriaId\":\"E1BBD259-8F51-4AF8-BE0A-04BEB2407F62\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:xforwoocommerce:improved_sale_badges:*:*:*:*:*:wordpress:*:*\",\"versionEndExcluding\":\"4.4.0\",\"matchCriteriaId\":\"9C8FFD0C-805D-43FE-AF3E-2EF0EFD0231E\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:xforwoocommerce:live_product_editor:*:*:*:*:*:wordpress:*:*\",\"versionEndExcluding\":\"4.7.0\",\"matchCriteriaId\":\"2579E688-CAB2-4BAC-90A1-FF805A380C2B\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:xforwoocommerce:live_search:*:*:*:*:*:wordpress:*:*\",\"versionEndExcluding\":\"2.1.0\",\"matchCriteriaId\":\"D613DF5D-D003-4B93-81B8-0B58257B334B\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:xforwoocommerce:package_quantity:*:*:*:*:*:wordpress:*:*\",\"versionEndExcluding\":\"1.2.0\",\"matchCriteriaId\":\"B45F34B1-5F06-492E-A257-1ECD3374626A\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:xforwoocommerce:price_commander:*:*:*:*:*:wordpress:*:*\",\"versionEndExcluding\":\"1.3.0\",\"matchCriteriaId\":\"F591A0E8-4B35-4434-9081-C1F50D6F2992\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:xforwoocommerce:product_filter:*:*:*:*:*:wordpress:*:*\",\"versionEndExcluding\":\"8.2.0\",\"matchCriteriaId\":\"7753ADC1-DCDC-43FB-82E1-3504762FAF94\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:xforwoocommerce:product_loops:*:*:*:*:*:wordpress:*:*\",\"versionEndExcluding\":\"1.7.0\",\"matchCriteriaId\":\"B43756CF-DCF1-4BD6-AF3C-C3C564C9E85E\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:xforwoocommerce:share\\\\,_print_and_pdf_products:*:*:*:*:*:wordpress:*:*\",\"versionEndExcluding\":\"2.8.0\",\"matchCriteriaId\":\"A9523695-0B82-469A-8099-AF2E98D77D7B\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:xforwoocommerce:warranties_and_returns:*:*:*:*:*:wordpress:*:*\",\"versionEndExcluding\":\"5.3.0\",\"matchCriteriaId\":\"E1887B1A-86B3-49A3-AF94-86AE04C24DE0\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:xforwoocommerce:xforwoocommerce:*:*:*:*:*:wordpress:*:*\",\"versionEndExcluding\":\"1.7.0\",\"matchCriteriaId\":\"EEE062F3-7EC3-4FBC-A5E9-CCE825C2B36F\"}]}]}],\"references\":[{\"url\":\"https://blog.nintechnet.com/16-woocommerce-product-add-ons-plugins-fixed-vulnerabilities/\",\"source\":\"security@wordfence.com\",\"tags\":[\"Exploit\",\"Third Party Advisory\"]},{\"url\":\"https://www.wordfence.com/threat-intel/vulnerabilities/id/05481984-7c18-4ec7-8d7c-831809c3e86b?source=cve\",\"source\":\"security@wordfence.com\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://xforwoocommerce.com/blog/change-log/xforwoocommerce-1-7-0/\",\"source\":\"security@wordfence.com\",\"tags\":[\"Vendor Advisory\"]},{\"url\":\"https://blog.nintechnet.com/16-woocommerce-product-add-ons-plugins-fixed-vulnerabilities/\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Exploit\",\"Third Party Advisory\"]},{\"url\":\"https://www.wordfence.com/threat-intel/vulnerabilities/id/05481984-7c18-4ec7-8d7c-831809c3e86b?source=cve\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://xforwoocommerce.com/blog/change-log/xforwoocommerce-1-7-0/\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Vendor Advisory\"]}]}}",
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"https://www.wordfence.com/threat-intel/vulnerabilities/id/05481984-7c18-4ec7-8d7c-831809c3e86b?source=cve\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://blog.nintechnet.com/16-woocommerce-product-add-ons-plugins-fixed-vulnerabilities/\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://xforwoocommerce.com/blog/change-log/xforwoocommerce-1-7-0/\", \"tags\": [\"x_transferred\"]}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2024-08-03T17:23:10.474Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2021-4337\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"total\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-12-23T16:00:34.189441Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-12-23T16:00:35.763Z\"}}], \"cna\": {\"title\": \"Multiple XforWooCommerce Add-On Plugins (Various Versions) - Missing Authorization\", \"credits\": [{\"lang\": \"en\", \"type\": \"finder\", \"value\": \"Jerome Bruandet\"}], \"metrics\": [{\"cvssV3_1\": {\"version\": \"3.1\", \"baseScore\": 8.8, \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\"}}], \"affected\": [{\"vendor\": \"XforWooCommerce\", \"product\": \"Package Quantity Discount\", \"versions\": [{\"status\": \"affected\", \"version\": \"0\", \"lessThan\": \"1.2.0\", \"versionType\": \"semver\"}], \"defaultStatus\": \"unaffected\"}, {\"vendor\": \"XforWooCommerce\", \"product\": \"Price Commander for WooCommerce\", \"versions\": [{\"status\": \"affected\", \"version\": \"0\", \"lessThan\": \"1.3.0\", \"versionType\": \"semver\"}], \"defaultStatus\": \"unaffected\"}, {\"vendor\": \"XforWooCommerce\", \"product\": \"Bulk Add to Cart for WooCommerce\", \"versions\": [{\"status\": \"affected\", \"version\": \"0\", \"lessThan\": \"1.3.0\", \"versionType\": \"semver\"}], \"defaultStatus\": \"unaffected\"}, {\"vendor\": \"XforWooCommerce\", \"product\": \"Floating Cart for WooCommerce\", \"versions\": [{\"status\": \"affected\", \"version\": \"0\", \"lessThan\": \"1.3.0\", \"versionType\": \"semver\"}], \"defaultStatus\": \"unaffected\"}, {\"vendor\": \"XforWooCommerce\", \"product\": \"Comment and Review Spam Control for WooCommerce\", \"versions\": [{\"status\": \"affected\", \"version\": \"0\", \"lessThan\": \"1.5.0\", \"versionType\": \"semver\"}], \"defaultStatus\": \"unaffected\"}, {\"vendor\": \"XforWooCommerce\", \"product\": \"Add Product Tabs for WooCommerce\", \"versions\": [{\"status\": \"affected\", \"version\": \"0\", \"lessThan\": \"1.5.0\", \"versionType\": \"semver\"}], \"defaultStatus\": \"unaffected\"}, {\"vendor\": \"XforWooCommerce\", \"product\": \"Autopilot SEO for WooCommerce\", \"versions\": [{\"status\": \"affected\", \"version\": \"0\", \"lessThan\": \"1.6.0\", \"versionType\": \"semver\"}], \"defaultStatus\": \"unaffected\"}, {\"vendor\": \"XforWooCommerce\", \"product\": \"XforWooCommerce\", \"versions\": [{\"status\": \"affected\", \"version\": \"0\", \"lessThan\": \"1.7.0\", \"versionType\": \"semver\"}], \"defaultStatus\": \"unaffected\"}, {\"vendor\": \"XforWooCommerce\", \"product\": \"Product Loops for WooCommerce\", \"versions\": [{\"status\": \"affected\", \"version\": \"0\", \"lessThan\": \"1.7.0\", \"versionType\": \"semver\"}], \"defaultStatus\": \"unaffected\"}, {\"vendor\": \"XforWooCommerce\", \"product\": \"Live Search for WooCommerce\", \"versions\": [{\"status\": \"affected\", \"version\": \"0\", \"lessThan\": \"2.1.0\", \"versionType\": \"semver\"}], \"defaultStatus\": \"unaffected\"}, {\"vendor\": \"XforWooCommerce\", \"product\": \"Share, Print and PDF Products for WooCommerce\", \"versions\": [{\"status\": \"affected\", \"version\": \"0\", \"lessThan\": \"2.8.0\", \"versionType\": \"semver\"}], \"defaultStatus\": \"unaffected\"}, {\"vendor\": \"XforWooCommerce\", \"product\": \"Improved Sale Badges for WooCommerce\", \"versions\": [{\"status\": \"affected\", \"version\": \"0\", \"lessThan\": \"4.4.0\", \"versionType\": \"semver\"}], \"defaultStatus\": \"unaffected\"}, {\"vendor\": \"XforWooCommerce\", \"product\": \"Live Product Editor for WooCommerce\", \"versions\": [{\"status\": \"affected\", \"version\": \"0\", \"lessThan\": \"4.7.0\", \"versionType\": \"semver\"}], \"defaultStatus\": \"unaffected\"}, {\"vendor\": \"XforWooCommerce\", \"product\": \"Warranties and Returns for WooCommerce\", \"versions\": [{\"status\": \"affected\", \"version\": \"0\", \"lessThan\": \"5.3.0\", \"versionType\": \"semver\"}], \"defaultStatus\": \"unaffected\"}, {\"vendor\": \"XforWooCommerce\", \"product\": \"Improved Product Options for WooCommerce\", \"versions\": [{\"status\": \"affected\", \"version\": \"0\", \"lessThan\": \"5.3.0\", \"versionType\": \"semver\"}], \"defaultStatus\": \"unaffected\"}, {\"vendor\": \"XforWooCommerce\", \"product\": \"Product Filter for WooCommerce\", \"versions\": [{\"status\": \"affected\", \"version\": \"0\", \"lessThan\": \"8.2.0\", \"versionType\": \"semver\"}], \"defaultStatus\": \"unaffected\"}], \"timeline\": [{\"lang\": \"en\", \"time\": \"2021-09-07T00:00:00.000Z\", \"value\": \"Disclosed\"}], \"references\": [{\"url\": \"https://www.wordfence.com/threat-intel/vulnerabilities/id/05481984-7c18-4ec7-8d7c-831809c3e86b?source=cve\"}, {\"url\": \"https://blog.nintechnet.com/16-woocommerce-product-add-ons-plugins-fixed-vulnerabilities/\"}, {\"url\": \"https://xforwoocommerce.com/blog/change-log/xforwoocommerce-1-7-0/\"}], \"descriptions\": [{\"lang\": \"en\", \"value\": \"Sixteen XforWooCommerce Add-On Plugins for WordPress are vulnerable to authorization bypass due to a missing capability check on the wp_ajax_svx_ajax_factory function in various versions listed below. This makes it possible for authenticated attackers, with subscriber-level permissions and above, to read, edit, or delete WordPress settings, plugin settings, and to arbitrarily list all users on a WordPress website. The plugins impacted are: Product Filter for WooCommerce \u003c 8.2.0, Improved Product Options for WooCommerce \u003c 5.3.0, Improved Sale Badges for WooCommerce \u003c 4.4.0, Share, Print and PDF Products for WooCommerce \u003c 2.8.0, Product Loops for WooCommerce \u003c 1.7.0, XforWooCommerce \u003c 1.7.0, Package Quantity Discount \u003c 1.2.0, Price Commander for WooCommerce \u003c 1.3.0, Comment and Review Spam Control for WooCommerce \u003c 1.5.0, Add Product Tabs for WooCommerce \u003c 1.5.0, Autopilot SEO for WooCommerce \u003c 1.6.0, Floating Cart \u003c 1.3.0, Live Search for WooCommerce \u003c 2.1.0, Bulk Add to Cart for WooCommerce \u003c 1.3.0, Live Product Editor for WooCommerce \u003c 4.7.0, and Warranties and Returns for WooCommerce \u003c 5.3.0.\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-862\", \"description\": \"CWE-862 Missing Authorization\"}]}], \"providerMetadata\": {\"orgId\": \"b15e7b5b-3da4-40ae-a43c-f7aa60e62599\", \"shortName\": \"Wordfence\", \"dateUpdated\": \"2026-04-08T16:33:21.807Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2021-4337\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-04-08T16:33:21.807Z\", \"dateReserved\": \"2023-06-06T12:20:33.347Z\", \"assignerOrgId\": \"b15e7b5b-3da4-40ae-a43c-f7aa60e62599\", \"datePublished\": \"2023-06-07T12:43:07.139Z\", \"assignerShortName\": \"Wordfence\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}

GHSA-XF7W-7876-XWJ4

Vulnerability from github – Published: 2023-06-07 15:30 – Updated: 2024-04-04 04:39

Details

Severity ?

8.8 (High)


                  
                    CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2021-4337"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-862"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2023-06-07T13:15:09Z",
    "severity": "HIGH"
  },
  "details": "Sixteen XforWooCommerce Add-On Plugins for WordPress are vulnerable to authorization bypass due to a missing capability check on the wp_ajax_svx_ajax_factory function in various versions listed below. This makes it possible for authenticated attackers, with subscriber-level permissions and above, to read, edit, or delete WordPress settings, plugin settings, and to arbitrarily list all users on a WordPress website. The plugins impacted are: Product Filter for WooCommerce \u003c 8.2.0, Improved Product Options for WooCommerce \u003c 5.3.0, Improved Sale Badges for WooCommerce \u003c 4.4.0, Share, Print and PDF Products for WooCommerce \u003c 2.8.0, Product Loops for WooCommerce \u003c 1.7.0, XforWooCommerce \u003c 1.7.0, Package Quantity Discount \u003c 1.2.0, Price Commander for WooCommerce \u003c 1.3.0, Comment and Review Spam Control for WooCommerce \u003c 1.5.0, Add Product Tabs for WooCommerce \u003c 1.5.0, Autopilot SEO for WooCommerce \u003c 1.6.0, Floating Cart \u003c 1.3.0, Live Search for WooCommerce \u003c 2.1.0, Bulk Add to Cart for WooCommerce \u003c 1.3.0, Live Product Editor for WooCommerce \u003c 4.7.0, and Warranties and Returns for WooCommerce \u003c 5.3.0.",
  "id": "GHSA-xf7w-7876-xwj4",
  "modified": "2024-04-04T04:39:20Z",
  "published": "2023-06-07T15:30:17Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-4337"
    },
    {
      "type": "WEB",
      "url": "https://blog.nintechnet.com/16-woocommerce-product-add-ons-plugins-fixed-vulnerabilities"
    },
    {
      "type": "WEB",
      "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/05481984-7c18-4ec7-8d7c-831809c3e86b?source=cve"
    },
    {
      "type": "WEB",
      "url": "https://xforwoocommerce.com/blog/change-log/xforwoocommerce-1-7-0"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

FKIE_CVE-2021-4337

Vulnerability from fkie_nvd - Published: 2023-06-07 13:15 - Updated: 2026-04-08 17:16

Severity ?

8.8 (High) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
8.8 (High) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Summary

References

URL	Tags
security@wordfence.com	https://blog.nintechnet.com/16-woocommerce-product-add-ons-plugins-fixed-vulnerabilities/	Exploit, Third Party Advisory
security@wordfence.com	https://www.wordfence.com/threat-intel/vulnerabilities/id/05481984-7c18-4ec7-8d7c-831809c3e86b?source=cve	Third Party Advisory
security@wordfence.com	https://xforwoocommerce.com/blog/change-log/xforwoocommerce-1-7-0/	Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108	https://blog.nintechnet.com/16-woocommerce-product-add-ons-plugins-fixed-vulnerabilities/	Exploit, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108	https://www.wordfence.com/threat-intel/vulnerabilities/id/05481984-7c18-4ec7-8d7c-831809c3e86b?source=cve	Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108	https://xforwoocommerce.com/blog/change-log/xforwoocommerce-1-7-0/	Vendor Advisory

Impacted products

Vendor	Product	Version
xforwoocommerce	add_product_tabs	*
xforwoocommerce	autopilot_seo	*
xforwoocommerce	bulk_add_to_cart	*
xforwoocommerce	comment_and_review_spam_control	*
xforwoocommerce	floating_cart	*
xforwoocommerce	improved_product_options	*
xforwoocommerce	improved_sale_badges	*
xforwoocommerce	live_product_editor	*
xforwoocommerce	live_search	*
xforwoocommerce	package_quantity	*
xforwoocommerce	price_commander	*
xforwoocommerce	product_filter	*
xforwoocommerce	product_loops	*
xforwoocommerce	share\,_print_and_pdf_products	*
xforwoocommerce	warranties_and_returns	*
xforwoocommerce	xforwoocommerce	*

JSON

To clipboard

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:xforwoocommerce:add_product_tabs:*:*:*:*:*:wordpress:*:*",
              "matchCriteriaId": "EF32845C-A082-4218-A2DE-9E70FE404A5B",
              "versionEndExcluding": "1.5.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:xforwoocommerce:autopilot_seo:*:*:*:*:*:wordpress:*:*",
              "matchCriteriaId": "F2F6559F-BF4C-4963-BEBB-8D782606A4C4",
              "versionEndExcluding": "1.6.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:xforwoocommerce:bulk_add_to_cart:*:*:*:*:*:wordpress:*:*",
              "matchCriteriaId": "DA1EFA61-4DFF-4BAF-AD21-0FBEFDFB185B",
              "versionEndExcluding": "1.3.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:xforwoocommerce:comment_and_review_spam_control:*:*:*:*:*:wordpress:*:*",
              "matchCriteriaId": "A062382F-5B88-4ABD-9887-B1852DDD17E5",
              "versionEndExcluding": "1.5.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:xforwoocommerce:floating_cart:*:*:*:*:*:wordpress:*:*",
              "matchCriteriaId": "3CA7CE2F-63FF-4EAA-B3C6-393F43DA9F31",
              "versionEndExcluding": "1.3.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:xforwoocommerce:improved_product_options:*:*:*:*:*:wordpress:*:*",
              "matchCriteriaId": "E1BBD259-8F51-4AF8-BE0A-04BEB2407F62",
              "versionEndExcluding": "5.3.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:xforwoocommerce:improved_sale_badges:*:*:*:*:*:wordpress:*:*",
              "matchCriteriaId": "9C8FFD0C-805D-43FE-AF3E-2EF0EFD0231E",
              "versionEndExcluding": "4.4.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:xforwoocommerce:live_product_editor:*:*:*:*:*:wordpress:*:*",
              "matchCriteriaId": "2579E688-CAB2-4BAC-90A1-FF805A380C2B",
              "versionEndExcluding": "4.7.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:xforwoocommerce:live_search:*:*:*:*:*:wordpress:*:*",
              "matchCriteriaId": "D613DF5D-D003-4B93-81B8-0B58257B334B",
              "versionEndExcluding": "2.1.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:xforwoocommerce:package_quantity:*:*:*:*:*:wordpress:*:*",
              "matchCriteriaId": "B45F34B1-5F06-492E-A257-1ECD3374626A",
              "versionEndExcluding": "1.2.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:xforwoocommerce:price_commander:*:*:*:*:*:wordpress:*:*",
              "matchCriteriaId": "F591A0E8-4B35-4434-9081-C1F50D6F2992",
              "versionEndExcluding": "1.3.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:xforwoocommerce:product_filter:*:*:*:*:*:wordpress:*:*",
              "matchCriteriaId": "7753ADC1-DCDC-43FB-82E1-3504762FAF94",
              "versionEndExcluding": "8.2.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:xforwoocommerce:product_loops:*:*:*:*:*:wordpress:*:*",
              "matchCriteriaId": "B43756CF-DCF1-4BD6-AF3C-C3C564C9E85E",
              "versionEndExcluding": "1.7.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:xforwoocommerce:share\\,_print_and_pdf_products:*:*:*:*:*:wordpress:*:*",
              "matchCriteriaId": "A9523695-0B82-469A-8099-AF2E98D77D7B",
              "versionEndExcluding": "2.8.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:xforwoocommerce:warranties_and_returns:*:*:*:*:*:wordpress:*:*",
              "matchCriteriaId": "E1887B1A-86B3-49A3-AF94-86AE04C24DE0",
              "versionEndExcluding": "5.3.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:xforwoocommerce:xforwoocommerce:*:*:*:*:*:wordpress:*:*",
              "matchCriteriaId": "EEE062F3-7EC3-4FBC-A5E9-CCE825C2B36F",
              "versionEndExcluding": "1.7.0",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Sixteen XforWooCommerce Add-On Plugins for WordPress are vulnerable to authorization bypass due to a missing capability check on the wp_ajax_svx_ajax_factory function in various versions listed below. This makes it possible for authenticated attackers, with subscriber-level permissions and above, to read, edit, or delete WordPress settings, plugin settings, and to arbitrarily list all users on a WordPress website. The plugins impacted are: Product Filter for WooCommerce \u003c 8.2.0, Improved Product Options for WooCommerce \u003c 5.3.0, Improved Sale Badges for WooCommerce \u003c 4.4.0, Share, Print and PDF Products for WooCommerce \u003c 2.8.0, Product Loops for WooCommerce \u003c 1.7.0, XforWooCommerce \u003c 1.7.0, Package Quantity Discount \u003c 1.2.0, Price Commander for WooCommerce \u003c 1.3.0, Comment and Review Spam Control for WooCommerce \u003c 1.5.0, Add Product Tabs for WooCommerce \u003c 1.5.0, Autopilot SEO for WooCommerce \u003c 1.6.0, Floating Cart \u003c 1.3.0, Live Search for WooCommerce \u003c 2.1.0, Bulk Add to Cart for WooCommerce \u003c 1.3.0, Live Product Editor for WooCommerce \u003c 4.7.0, and Warranties and Returns for WooCommerce \u003c 5.3.0."
    }
  ],
  "id": "CVE-2021-4337",
  "lastModified": "2026-04-08T17:16:37.967",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 8.8,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 5.9,
        "source": "security@wordfence.com",
        "type": "Secondary"
      },
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 8.8,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 5.9,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ]
  },
  "published": "2023-06-07T13:15:09.437",
  "references": [
    {
      "source": "security@wordfence.com",
      "tags": [
        "Exploit",
        "Third Party Advisory"
      ],
      "url": "https://blog.nintechnet.com/16-woocommerce-product-add-ons-plugins-fixed-vulnerabilities/"
    },
    {
      "source": "security@wordfence.com",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/05481984-7c18-4ec7-8d7c-831809c3e86b?source=cve"
    },
    {
      "source": "security@wordfence.com",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "https://xforwoocommerce.com/blog/change-log/xforwoocommerce-1-7-0/"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Exploit",
        "Third Party Advisory"
      ],
      "url": "https://blog.nintechnet.com/16-woocommerce-product-add-ons-plugins-fixed-vulnerabilities/"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/05481984-7c18-4ec7-8d7c-831809c3e86b?source=cve"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "https://xforwoocommerce.com/blog/change-log/xforwoocommerce-1-7-0/"
    }
  ],
  "sourceIdentifier": "security@wordfence.com",
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-862"
        }
      ],
      "source": "security@wordfence.com",
      "type": "Primary"
    },
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-862"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Secondary"
    }
  ]
}

GSD-2021-4337

Vulnerability from gsd - Updated: 2023-12-13 01:23

Details

Aliases

CVE-2021-4337

Aliases

CVE-2021-4337

JSON

To clipboard

{
  "GSD": {
    "alias": "CVE-2021-4337",
    "id": "GSD-2021-4337"
  },
  "gsd": {
    "metadata": {
      "exploitCode": "unknown",
      "remediation": "unknown",
      "reportConfidence": "confirmed",
      "type": "vulnerability"
    },
    "osvSchema": {
      "aliases": [
        "CVE-2021-4337"
      ],
      "details": "Sixteen XforWooCommerce Add-On Plugins for WordPress are vulnerable to authorization bypass due to a missing capability check on the wp_ajax_svx_ajax_factory function in various versions listed below. This makes it possible for authenticated attackers, with subscriber-level permissions and above, to read, edit, or delete WordPress settings, plugin settings, and to arbitrarily list all users on a WordPress website. The plugins impacted are: Product Filter for WooCommerce \u003c 8.2.0, Improved Product Options for WooCommerce \u003c 5.3.0, Improved Sale Badges for WooCommerce \u003c 4.4.0, Share, Print and PDF Products for WooCommerce \u003c 2.8.0, Product Loops for WooCommerce \u003c 1.7.0, XforWooCommerce \u003c 1.7.0, Package Quantity Discount \u003c 1.2.0, Price Commander for WooCommerce \u003c 1.3.0, Comment and Review Spam Control for WooCommerce \u003c 1.5.0, Add Product Tabs for WooCommerce \u003c 1.5.0, Autopilot SEO for WooCommerce \u003c 1.6.0, Floating Cart \u003c 1.3.0, Live Search for WooCommerce \u003c 2.1.0, Bulk Add to Cart for WooCommerce \u003c 1.3.0, Live Product Editor for WooCommerce \u003c 4.7.0, and Warranties and Returns for WooCommerce \u003c 5.3.0.",
      "id": "GSD-2021-4337",
      "modified": "2023-12-13T01:23:11.728698Z",
      "schema_version": "1.4.0"
    }
  },
  "namespaces": {
    "cve.org": {
      "CVE_data_meta": {
        "ASSIGNER": "security@wordfence.com",
        "ID": "CVE-2021-4337",
        "STATE": "PUBLIC"
      },
      "affects": {
        "vendor": {
          "vendor_data": [
            {
              "product": {
                "product_data": [
                  {
                    "product_name": "Product Filter for WooCommerce",
                    "version": {
                      "version_data": [
                        {
                          "version_affected": "\u003c",
                          "version_name": "*",
                          "version_value": "8.2.0"
                        }
                      ]
                    }
                  },
                  {
                    "product_name": "Improved Sale Badges for WooCommerce",
                    "version": {
                      "version_data": [
                        {
                          "version_affected": "\u003c",
                          "version_name": "*",
                          "version_value": "4.4.0"
                        }
                      ]
                    }
                  },
                  {
                    "product_name": "XforWooCommerce",
                    "version": {
                      "version_data": [
                        {
                          "version_affected": "\u003c",
                          "version_name": "*",
                          "version_value": "1.7.0"
                        }
                      ]
                    }
                  },
                  {
                    "product_name": "Live Product Editor for WooCommerce",
                    "version": {
                      "version_data": [
                        {
                          "version_affected": "\u003c",
                          "version_name": "*",
                          "version_value": "4.7.0"
                        }
                      ]
                    }
                  },
                  {
                    "product_name": "Warranties and Returns for WooCommerce",
                    "version": {
                      "version_data": [
                        {
                          "version_affected": "\u003c",
                          "version_name": "*",
                          "version_value": "5.3.0"
                        }
                      ]
                    }
                  },
                  {
                    "product_name": "Price Commander for WooCommerce",
                    "version": {
                      "version_data": [
                        {
                          "version_affected": "\u003c",
                          "version_name": "*",
                          "version_value": "1.3.0"
                        }
                      ]
                    }
                  },
                  {
                    "product_name": "Improved Product Options for WooCommerce",
                    "version": {
                      "version_data": [
                        {
                          "version_affected": "\u003c",
                          "version_name": "*",
                          "version_value": "5.3.0"
                        }
                      ]
                    }
                  },
                  {
                    "product_name": "Comment and Review Spam Control for WooCommerce",
                    "version": {
                      "version_data": [
                        {
                          "version_affected": "\u003c",
                          "version_name": "*",
                          "version_value": "1.5.0"
                        }
                      ]
                    }
                  },
                  {
                    "product_name": "Package Quantity Discount",
                    "version": {
                      "version_data": [
                        {
                          "version_affected": "\u003c",
                          "version_name": "*",
                          "version_value": "1.2.0"
                        }
                      ]
                    }
                  },
                  {
                    "product_name": "Share, Print and PDF Products for WooCommerce",
                    "version": {
                      "version_data": [
                        {
                          "version_affected": "\u003c",
                          "version_name": "*",
                          "version_value": "2.8.0"
                        }
                      ]
                    }
                  },
                  {
                    "product_name": "Bulk Add to Cart for WooCommerce",
                    "version": {
                      "version_data": [
                        {
                          "version_affected": "\u003c",
                          "version_name": "*",
                          "version_value": "1.3.0"
                        }
                      ]
                    }
                  },
                  {
                    "product_name": "Live Search for WooCommerce",
                    "version": {
                      "version_data": [
                        {
                          "version_affected": "\u003c",
                          "version_name": "*",
                          "version_value": "2.1.0"
                        }
                      ]
                    }
                  },
                  {
                    "product_name": "Floating Cart for WooCommerce",
                    "version": {
                      "version_data": [
                        {
                          "version_affected": "\u003c",
                          "version_name": "*",
                          "version_value": "1.3.0"
                        }
                      ]
                    }
                  },
                  {
                    "product_name": "Add Product Tabs for WooCommerce",
                    "version": {
                      "version_data": [
                        {
                          "version_affected": "\u003c",
                          "version_name": "*",
                          "version_value": "1.5.0"
                        }
                      ]
                    }
                  },
                  {
                    "product_name": "Product Loops for WooCommerce",
                    "version": {
                      "version_data": [
                        {
                          "version_affected": "\u003c",
                          "version_name": "*",
                          "version_value": "1.7.0"
                        }
                      ]
                    }
                  },
                  {
                    "product_name": "Autopilot SEO for WooCommerce",
                    "version": {
                      "version_data": [
                        {
                          "version_affected": "\u003c",
                          "version_name": "*",
                          "version_value": "1.6.0"
                        }
                      ]
                    }
                  }
                ]
              },
              "vendor_name": "XforWooCommerce"
            }
          ]
        }
      },
      "credits": [
        {
          "lang": "en",
          "value": "Jerome Bruandet"
        }
      ],
      "data_format": "MITRE",
      "data_type": "CVE",
      "data_version": "4.0",
      "description": {
        "description_data": [
          {
            "lang": "eng",
            "value": "Sixteen XforWooCommerce Add-On Plugins for WordPress are vulnerable to authorization bypass due to a missing capability check on the wp_ajax_svx_ajax_factory function in various versions listed below. This makes it possible for authenticated attackers, with subscriber-level permissions and above, to read, edit, or delete WordPress settings, plugin settings, and to arbitrarily list all users on a WordPress website. The plugins impacted are: Product Filter for WooCommerce \u003c 8.2.0, Improved Product Options for WooCommerce \u003c 5.3.0, Improved Sale Badges for WooCommerce \u003c 4.4.0, Share, Print and PDF Products for WooCommerce \u003c 2.8.0, Product Loops for WooCommerce \u003c 1.7.0, XforWooCommerce \u003c 1.7.0, Package Quantity Discount \u003c 1.2.0, Price Commander for WooCommerce \u003c 1.3.0, Comment and Review Spam Control for WooCommerce \u003c 1.5.0, Add Product Tabs for WooCommerce \u003c 1.5.0, Autopilot SEO for WooCommerce \u003c 1.6.0, Floating Cart \u003c 1.3.0, Live Search for WooCommerce \u003c 2.1.0, Bulk Add to Cart for WooCommerce \u003c 1.3.0, Live Product Editor for WooCommerce \u003c 4.7.0, and Warranties and Returns for WooCommerce \u003c 5.3.0."
          }
        ]
      },
      "impact": {
        "cvss": [
          {
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          }
        ]
      },
      "problemtype": {
        "problemtype_data": [
          {
            "description": [
              {
                "lang": "eng",
                "value": "CWE-862 Missing Authorization"
              }
            ]
          }
        ]
      },
      "references": {
        "reference_data": [
          {
            "name": "https://www.wordfence.com/threat-intel/vulnerabilities/id/05481984-7c18-4ec7-8d7c-831809c3e86b?source=cve",
            "refsource": "MISC",
            "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/05481984-7c18-4ec7-8d7c-831809c3e86b?source=cve"
          },
          {
            "name": "https://blog.nintechnet.com/16-woocommerce-product-add-ons-plugins-fixed-vulnerabilities/",
            "refsource": "MISC",
            "url": "https://blog.nintechnet.com/16-woocommerce-product-add-ons-plugins-fixed-vulnerabilities/"
          },
          {
            "name": "https://xforwoocommerce.com/blog/change-log/xforwoocommerce-1-7-0/",
            "refsource": "MISC",
            "url": "https://xforwoocommerce.com/blog/change-log/xforwoocommerce-1-7-0/"
          }
        ]
      }
    },
    "nvd.nist.gov": {
      "configurations": {
        "CVE_data_version": "4.0",
        "nodes": [
          {
            "children": [],
            "cpe_match": [
              {
                "cpe23Uri": "cpe:2.3:a:xforwoocommerce:xforwoocommerce:*:*:*:*:*:wordpress:*:*",
                "cpe_name": [],
                "versionEndExcluding": "1.7.0",
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:xforwoocommerce:warranties_and_returns:*:*:*:*:*:wordpress:*:*",
                "cpe_name": [],
                "versionEndExcluding": "5.3.0",
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:xforwoocommerce:share\\,_print_and_pdf_products:*:*:*:*:*:wordpress:*:*",
                "cpe_name": [],
                "versionEndExcluding": "2.8.0",
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:xforwoocommerce:product_loops:*:*:*:*:*:wordpress:*:*",
                "cpe_name": [],
                "versionEndExcluding": "1.7.0",
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:xforwoocommerce:product_filter:*:*:*:*:*:wordpress:*:*",
                "cpe_name": [],
                "versionEndExcluding": "8.2.0",
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:xforwoocommerce:price_commander:*:*:*:*:*:wordpress:*:*",
                "cpe_name": [],
                "versionEndExcluding": "1.3.0",
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:xforwoocommerce:package_quantity:*:*:*:*:*:wordpress:*:*",
                "cpe_name": [],
                "versionEndExcluding": "1.2.0",
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:xforwoocommerce:live_search:*:*:*:*:*:wordpress:*:*",
                "cpe_name": [],
                "versionEndExcluding": "2.1.0",
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:xforwoocommerce:live_product_editor:*:*:*:*:*:wordpress:*:*",
                "cpe_name": [],
                "versionEndExcluding": "4.7.0",
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:xforwoocommerce:improved_sale_badges:*:*:*:*:*:wordpress:*:*",
                "cpe_name": [],
                "versionEndExcluding": "4.4.0",
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:xforwoocommerce:improved_product_options:*:*:*:*:*:wordpress:*:*",
                "cpe_name": [],
                "versionEndExcluding": "5.3.0",
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:xforwoocommerce:floating_cart:*:*:*:*:*:wordpress:*:*",
                "cpe_name": [],
                "versionEndExcluding": "1.3.0",
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:xforwoocommerce:comment_and_review_spam_control:*:*:*:*:*:wordpress:*:*",
                "cpe_name": [],
                "versionEndExcluding": "1.5.0",
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:xforwoocommerce:bulk_add_to_cart:*:*:*:*:*:wordpress:*:*",
                "cpe_name": [],
                "versionEndExcluding": "1.3.0",
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:xforwoocommerce:autopilot_seo:*:*:*:*:*:wordpress:*:*",
                "cpe_name": [],
                "versionEndExcluding": "1.6.0",
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:xforwoocommerce:add_product_tabs:*:*:*:*:*:wordpress:*:*",
                "cpe_name": [],
                "versionEndExcluding": "1.5.0",
                "vulnerable": true
              }
            ],
            "operator": "OR"
          }
        ]
      },
      "cve": {
        "CVE_data_meta": {
          "ASSIGNER": "security@wordfence.com",
          "ID": "CVE-2021-4337"
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "en",
              "value": "Sixteen XforWooCommerce Add-On Plugins for WordPress are vulnerable to authorization bypass due to a missing capability check on the wp_ajax_svx_ajax_factory function in various versions listed below. This makes it possible for authenticated attackers, with subscriber-level permissions and above, to read, edit, or delete WordPress settings, plugin settings, and to arbitrarily list all users on a WordPress website. The plugins impacted are: Product Filter for WooCommerce \u003c 8.2.0, Improved Product Options for WooCommerce \u003c 5.3.0, Improved Sale Badges for WooCommerce \u003c 4.4.0, Share, Print and PDF Products for WooCommerce \u003c 2.8.0, Product Loops for WooCommerce \u003c 1.7.0, XforWooCommerce \u003c 1.7.0, Package Quantity Discount \u003c 1.2.0, Price Commander for WooCommerce \u003c 1.3.0, Comment and Review Spam Control for WooCommerce \u003c 1.5.0, Add Product Tabs for WooCommerce \u003c 1.5.0, Autopilot SEO for WooCommerce \u003c 1.6.0, Floating Cart \u003c 1.3.0, Live Search for WooCommerce \u003c 2.1.0, Bulk Add to Cart for WooCommerce \u003c 1.3.0, Live Product Editor for WooCommerce \u003c 4.7.0, and Warranties and Returns for WooCommerce \u003c 5.3.0."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "en",
                  "value": "CWE-862"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://blog.nintechnet.com/16-woocommerce-product-add-ons-plugins-fixed-vulnerabilities/",
              "refsource": "MISC",
              "tags": [
                "Exploit",
                "Third Party Advisory"
              ],
              "url": "https://blog.nintechnet.com/16-woocommerce-product-add-ons-plugins-fixed-vulnerabilities/"
            },
            {
              "name": "https://www.wordfence.com/threat-intel/vulnerabilities/id/05481984-7c18-4ec7-8d7c-831809c3e86b?source=cve",
              "refsource": "MISC",
              "tags": [
                "Third Party Advisory"
              ],
              "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/05481984-7c18-4ec7-8d7c-831809c3e86b?source=cve"
            },
            {
              "name": "https://xforwoocommerce.com/blog/change-log/xforwoocommerce-1-7-0/",
              "refsource": "MISC",
              "tags": [
                "Vendor Advisory"
              ],
              "url": "https://xforwoocommerce.com/blog/change-log/xforwoocommerce-1-7-0/"
            }
          ]
        }
      },
      "impact": {
        "baseMetricV3": {
          "cvssV3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "exploitabilityScore": 2.8,
          "impactScore": 5.9
        }
      },
      "lastModifiedDate": "2023-06-21T15:18Z",
      "publishedDate": "2023-06-07T13:15Z"
    }
  }
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

CVE-2021-4337 (GCVE-0-2021-4337)

GHSA-XF7W-7876-XWJ4

FKIE_CVE-2021-4337

GSD-2021-4337

Tags

Sightings

Nomenclature