The SMS Alert Order Notifications – WooCommerce plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.6.9. This is due to missing or incorrect nonce validation on the processBulkAction function. This makes it possible for unauthenticated attackers to delete pages and posts via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
References
Configurations
History
03 Apr 2025, 13:13
| Type | Values Removed | Values Added |
|---|---|---|
| First Time |
Cozyvision sms Alert Order Notifications
Cozyvision |
|
| CPE | cpe:2.3:a:cozyvision:sms_alert_order_notifications:*:*:*:*:*:wordpress:*:* | |
| References | () https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3039989%40sms-alert%2Ftrunk&old=3032487%40sms-alert%2Ftrunk&sfp_email=&sfph_mail=#file19 - Patch | |
| References | () https://www.wordfence.com/threat-intel/vulnerabilities/id/e7a28382-facb-43a7-892a-8ca9e7f0f62b?source=cve - Third Party Advisory | |
| CWE | CWE-352 |
21 Nov 2024, 08:50
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3039989%40sms-alert%2Ftrunk&old=3032487%40sms-alert%2Ftrunk&sfp_email=&sfph_mail=#file19 - | |
| References | () https://www.wordfence.com/threat-intel/vulnerabilities/id/e7a28382-facb-43a7-892a-8ca9e7f0f62b?source=cve - |
13 Mar 2024, 16:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2024-03-13 16:15
Updated : 2025-04-03 13:13
NVD link : CVE-2024-1489
Mitre link : CVE-2024-1489
CVE.ORG link : CVE-2024-1489
JSON object : View
Products Affected
cozyvision
- sms_alert_order_notifications
CWE
CWE-352
Cross-Site Request Forgery (CSRF)