CVE-2022-3451 — Product Stock Manager < 1.0.5 - Subscriber+ Unauthorised AJAX Calls
The Product Stock Manager WordPress plugin before 1.0.5 does not have authorisation and proper CSRF checks in multiple AJAX actions, allowing users with a role as low as subscri…
Published: 2022-11-07 · CVSS: 4.3 · CVSS 3.1
The Product Stock Manager WordPress plugin before 1.0.5 does not have authorisation and proper CSRF checks in multiple AJAX actions, allowing users with a role as low as subscriber to call them. One action in particular could allow to update arbitrary options
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7