{"schemaVersion":3,"id":"CVE-2022-2382","aliases":[],"status":"published","duplicateOf":null,"title":null,"description":"The Product Slider for WooCommerce WordPress plugin before 2.5.7 has flawed CSRF checks and lack authorisation in some of its AJAX actions, allowing any authenticated users, such as subscriber to call them. One in particular could allow them to delete arbitrary blog options.","dates":{"published":"2022-08-22T15:02:20.000Z","modified":"2024-08-03T00:39:06.347Z","reserved":null,"kevAdded":[],"kevDue":[]},"cvss":{"headline":{"score":5.4,"severity":"medium","version":"3.1","versionLabel":"v3.1","source":"wordfence","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L","computed":false,"selection":"backend-summary"},"metrics":[{"version":"3.1","versionLabel":"v3.1","source":"NVD","score":4.3,"severity":"medium","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","exploitability":null,"impact":null,"computed":false},{"version":"3.1","versionLabel":"v3.1","source":"wordfence","score":5.4,"severity":"medium","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L","exploitability":null,"impact":null,"computed":false}]},"epss":{"probability":0.00364,"percentile":0.29039,"severity":"low","asOf":"2026-10-22T00:00:00.000Z","change":{"pp":0.008000000000000021,"baselineDate":"2026-09-22T00:00:00.000Z","baselineScore":0.00356},"history":[{"date":"2026-09-14T00:00:00.000Z","score":0.00356,"percentile":null},{"date":"2026-09-15T00:00:00.000Z","score":0.00356,"percentile":null},{"date":"2026-09-16T00:00:00.000Z","score":0.00356,"percentile":null},{"date":"2026-09-17T00:00:00.000Z","score":0.00356,"percentile":null},{"date":"2026-09-18T00:00:00.000Z","score":0.00356,"percentile":null},{"date":"2026-09-19T00:00:00.000Z","score":0.00356,"percentile":null},{"date":"2026-09-20T00:00:00.000Z","score":0.00356,"percentile":null},{"date":"2026-09-21T00:00:00.000Z","score":0.00356,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.00356,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.00356,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.00356,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.00356,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.00356,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.00356,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.00356,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.00356,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.00356,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.00356,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.00356,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.00356,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.00356,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.00356,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.00356,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.00356,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.00356,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.00356,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.00356,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.00356,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.00356,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.00356,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.00356,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.00356,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.00364,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.00364,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.00364,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.00364,"percentile":null},{"date":"2026-10-20T00:00:00.000Z","score":0.00364,"percentile":null},{"date":"2026-10-21T00:00:00.000Z","score":0.00364,"percentile":null},{"date":"2026-10-22T00:00:00.000Z","score":0.00364,"percentile":0.29039}],"last30":[{"date":"2026-09-22T00:00:00.000Z","score":0.00356,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.00356,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.00356,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.00356,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.00356,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.00356,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.00356,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.00356,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.00356,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.00356,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.00356,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.00356,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.00356,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.00356,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.00356,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.00356,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.00356,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.00356,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.00356,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.00356,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.00356,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.00356,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.00356,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.00356,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.00364,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.00364,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.00364,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.00364,"percentile":null},{"date":"2026-10-20T00:00:00.000Z","score":0.00364,"percentile":null},{"date":"2026-10-21T00:00:00.000Z","score":0.00364,"percentile":null},{"date":"2026-10-22T00:00:00.000Z","score":0.00364,"percentile":0.29039}]},"kev":{"state":"not-listed","entries":[],"listedCount":0,"totalCatalogs":3,"catalogs":[{"source":"cisa","label":"CISA","listed":false,"entry":null},{"source":"enisa","label":"ENISA","listed":false,"entry":null},{"source":"circl","label":"CIRCL","listed":false,"entry":null}]},"ransomware":{"state":"none-recorded","sources":[]},"exploits":[{"id":"REF_57BB691E26613657","name":"Exploit Reference (wpscan.com)","source":"reference","url":"https://wpscan.com/vulnerability/777d4637-444b-4eda-bc21-95d3a3bf6cd3","maturity":"unknown","reliabilityScore":0.2,"verified":false,"type":null,"platforms":[],"requiresAuth":null,"exploitdb":null,"metasploit":null}],"exploitCount":1,"weaknesses":[{"id":"CWE-352","name":"Cross-Site Request Forgery (CSRF)","description":"The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor.","type":"weakness","status":"Stable","abstraction":"Compound","likelihoodOfExploit":"Medium","url":"https://cwe.mitre.org/data/definitions/352.html"},{"id":"CWE-862","name":"Missing Authorization","description":"The product does not perform an authorization check when an actor attempts to access a resource or perform an action.","type":"weakness","status":"Incomplete","abstraction":"Class","likelihoodOfExploit":"High","url":"https://cwe.mitre.org/data/definitions/862.html"}],"affected":[{"vendor":"shapedplugin","product":"product_slider_for_woocommerce","name":"product slider for woocommerce","label":"product_slider_for_woocommerce","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"< 2.5.7","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2.5.7","eol":null,"hubHref":"/vendor/shapedplugin/product_slider_for_woocommerce"},{"vendor":"unknown","product":"product slider for woocommerce","name":"Product Slider for WooCommerce","label":"product slider for woocommerce","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"≥ 2.5.7, < 2.5.7","noFixRecorded":false,"fixedIn":null}],"versionsText":"≥ 2.5.7, < 2.5.7","eol":null,"hubHref":"/vendor/unknown/product_slider_for_woocommerce"},{"vendor":"wordpress","product":"woo-product-slider","name":"Product Slider, Product Carousel and Product Grid Gallery for WooCommerce – Reno Product Slider (formerly Product Slider for WooCommerce)","label":"woo-product-slider","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"≤ 2.5.6 (fixed in 2.5.7)","noFixRecorded":false,"fixedIn":"2.5.7"}],"versionsText":"≤ 2.5.6 (fixed in 2.5.7)","eol":null,"hubHref":null}],"affectedCount":3,"eol":{"hasEol":false,"count":0},"references":[{"url":"https://wpscan.com/vulnerability/777d4637-444b-4eda-bc21-95d3a3bf6cd3","label":"wpscan.com/vulnerability/777d4637-444b-4eda-bc21-95d3a3bf6cd3","hostname":"wpscan.com","tags":["X Refsource MISC","Exploit","Third Party Advisory"]},{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e2e8d217-51a7-4653-bb23-c53f5c75cb85","label":"www.wordfence.com/threat-intel/vulnerabilities/id/e2e8d217-51a7-4653-bb23-c53f5c75cb85","hostname":"www.wordfence.com","tags":["Vendor Advisory"]}],"lineage":{"upstream":[],"downstream":[],"duplicates":[],"related":[]},"timeline":[{"kind":"published","date":"2022-08-22T15:02:20.000Z","label":"Published","detail":"Vulnerability first disclosed.","source":null},{"kind":"modified","date":"2024-08-03T00:39:06.347Z","label":"Last modified","detail":"Vulnerability information updated.","source":null}],"risk":{"score":32,"level":"medium","profile":"Default","thresholds":{"critical":75,"high":50,"medium":25,"low":10}},"meta":{"dataAsOf":"2026-10-22T16:30:33.393Z","stale":false,"partial":false}}