CVE-2022-3946 — Welcart e-Commerce < 2.8.4 - Subscriber+ Arbitrary Shipping Method Creation/Update/Deletion
The Welcart e-Commerce WordPress plugin before 2.8.4 does not have authorisation and CSRF in an AJAX action, allowing any logged-in user to create, update and delete shipping me…
Published: 2022-12-12 · CVSS: 6.5 · CVSS 3.1
The Welcart e-Commerce WordPress plugin before 2.8.4 does not have authorisation and CSRF in an AJAX action, allowing any logged-in user to create, update and delete shipping methods.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7