{"schemaVersion":3,"id":"CVE-2022-3154","aliases":[],"status":"published","duplicateOf":null,"title":null,"description":"The Woo Billingo Plus WordPress plugin before 4.4.5.4, Integration for Billingo & Gravity Forms WordPress plugin before 1.0.4, Integration for Szamlazz.hu & Gravity Forms WordPress plugin before 1.2.7 are lacking CSRF checks in various AJAX actions, which could allow attackers to make logged in Shop Managers and above perform unwanted actions, such as deactivate the plugin's license","dates":{"published":"2022-10-10T00:00:00.000Z","modified":"2024-08-03T01:00:10.538Z","reserved":null,"kevAdded":[],"kevDue":[]},"cvss":{"headline":{"score":8.8,"severity":"high","version":"3.1","versionLabel":"v3.1","source":"wordfence","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","computed":false,"selection":"backend-summary"},"metrics":[{"version":"3.1","versionLabel":"v3.1","source":"NVD","score":7.1,"severity":"high","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:L","exploitability":null,"impact":null,"computed":false},{"version":"3.1","versionLabel":"v3.1","source":"wordfence","score":8.8,"severity":"high","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","exploitability":null,"impact":null,"computed":false}]},"epss":{"probability":0.00413,"percentile":0.34423,"severity":"low","asOf":"2026-10-21T00:00:00.000Z","change":{"pp":0.043999999999999984,"baselineDate":"2026-09-21T00:00:00.000Z","baselineScore":0.00369},"history":[{"date":"2026-09-14T00:00:00.000Z","score":0.00357,"percentile":null},{"date":"2026-09-15T00:00:00.000Z","score":0.00369,"percentile":null},{"date":"2026-09-16T00:00:00.000Z","score":0.00369,"percentile":null},{"date":"2026-09-17T00:00:00.000Z","score":0.00369,"percentile":null},{"date":"2026-09-18T00:00:00.000Z","score":0.00369,"percentile":null},{"date":"2026-09-19T00:00:00.000Z","score":0.00369,"percentile":null},{"date":"2026-09-20T00:00:00.000Z","score":0.00369,"percentile":null},{"date":"2026-09-21T00:00:00.000Z","score":0.00369,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.00369,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.00369,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.00369,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.00369,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.00369,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.00369,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.00369,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.00369,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.00369,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.00369,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.00369,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.00369,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.00369,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.00369,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.00369,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.00413,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.00413,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.00413,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.00413,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.00413,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.00413,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.00413,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.00413,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.00413,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.00413,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.00413,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.00413,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.00413,"percentile":null},{"date":"2026-10-20T00:00:00.000Z","score":0.00413,"percentile":null},{"date":"2026-10-21T00:00:00.000Z","score":0.00413,"percentile":0.34423}],"last30":[{"date":"2026-09-21T00:00:00.000Z","score":0.00369,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.00369,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.00369,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.00369,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.00369,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.00369,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.00369,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.00369,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.00369,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.00369,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.00369,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.00369,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.00369,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.00369,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.00369,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.00369,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.00413,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.00413,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.00413,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.00413,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.00413,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.00413,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.00413,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.00413,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.00413,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.00413,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.00413,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.00413,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.00413,"percentile":null},{"date":"2026-10-20T00:00:00.000Z","score":0.00413,"percentile":null},{"date":"2026-10-21T00:00:00.000Z","score":0.00413,"percentile":0.34423}]},"kev":{"state":"not-listed","entries":[],"listedCount":0,"totalCatalogs":3,"catalogs":[{"source":"cisa","label":"CISA","listed":false,"entry":null},{"source":"enisa","label":"ENISA","listed":false,"entry":null},{"source":"circl","label":"CIRCL","listed":false,"entry":null}]},"ransomware":{"state":"none-recorded","sources":[]},"exploits":[{"id":"REF_5EE19657B79E1D40","name":"Exploit Reference (wpscan.com)","source":"reference","url":"https://wpscan.com/vulnerability/cda978b2-b31f-495d-8601-0aaa3e4b45cd","maturity":"unknown","reliabilityScore":0.2,"verified":false,"type":null,"platforms":[],"requiresAuth":null,"exploitdb":null,"metasploit":null}],"exploitCount":1,"weaknesses":[{"id":"CWE-352","name":"Cross-Site Request Forgery (CSRF)","description":"The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor.","type":"weakness","status":"Stable","abstraction":"Compound","likelihoodOfExploit":"Medium","url":"https://cwe.mitre.org/data/definitions/352.html"}],"affected":[{"vendor":"integration_for_billingo_\\&_gravity_forms_project","product":"integration_for_billingo_\\&_gravity_forms","name":"integration for billingo \\& gravity forms","label":"integration_for_billingo_\\&_gravity_forms","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"< 1.0.4","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 1.0.4","eol":null,"hubHref":"/vendor/integration_for_billingo__gravity_forms_project/integration_for_billingo__gravity_forms"},{"vendor":"integration_for_szamlazz.hu_\\&_gravity_forms_project","product":"integration_for_szamlazz.hu_\\&_gravity_forms","name":"integration for szamlazz.hu \\& gravity forms","label":"integration_for_szamlazz.hu_\\&_gravity_forms","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"< 1.2.7","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 1.2.7","eol":null,"hubHref":"/vendor/integration_for_szamlazzhu__gravity_forms_project/integration_for_szamlazzhu__gravity_forms"},{"vendor":"todo","product":"integration for billingo & gravity forms","name":"Integration for Billingo & Gravity Forms","label":"integration for billingo & gravity forms","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"≥ 1.0.4, < 1.0.4","noFixRecorded":false,"fixedIn":null}],"versionsText":"≥ 1.0.4, < 1.0.4","eol":null,"hubHref":"/vendor/todo/integration_for_billingo__gravity_forms"},{"vendor":"todo","product":"integration for szamlazz.hu & gravity forms","name":"Integration for Szamlazz.hu & Gravity Forms","label":"integration for szamlazz.hu & gravity forms","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"≥ 1.2.7, < 1.2.7","noFixRecorded":false,"fixedIn":null}],"versionsText":"≥ 1.2.7, < 1.2.7","eol":null,"hubHref":"/vendor/todo/integration_for_szamlazzhu__gravity_forms"},{"vendor":"todo","product":"woo billingo plus","name":"Woo Billingo Plus","label":"woo billingo plus","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"≥ 4.4.5.4, < 4.4.5.4","noFixRecorded":false,"fixedIn":null}],"versionsText":"≥ 4.4.5.4, < 4.4.5.4","eol":null,"hubHref":"/vendor/todo/woo_billingo_plus"},{"vendor":"woo_billingo_plus_project","product":"woo_billingo_plus","name":"woo billingo plus","label":"woo_billingo_plus","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"< 4.4.5.4","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 4.4.5.4","eol":null,"hubHref":"/vendor/woo_billingo_plus_project/woo_billingo_plus"},{"vendor":"wordpress","product":"integration-for-billingo-gravity-forms","name":"Integration for Billingo & Gravity Forms","label":"integration-for-billingo-gravity-forms","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"≤ 1.0.3 (fixed in 1.0.4)","noFixRecorded":false,"fixedIn":"1.0.4"}],"versionsText":"≤ 1.0.3 (fixed in 1.0.4)","eol":null,"hubHref":null},{"vendor":"wordpress","product":"integration-for-szamlazz-hu-gravity-forms","name":"Integration for Szamlazz.hu & Gravity Forms","label":"integration-for-szamlazz-hu-gravity-forms","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"≤ 1.2.6 (fixed in 1.2.7)","noFixRecorded":false,"fixedIn":"1.2.7"}],"versionsText":"≤ 1.2.6 (fixed in 1.2.7)","eol":null,"hubHref":null},{"vendor":"wordpress","product":"woo-billingo-plus","name":"Billingo Plus integráció WooCommerce-hez","label":"woo-billingo-plus","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"≤ 4.4.5.3 (fixed in 4.4.5.4)","noFixRecorded":false,"fixedIn":"4.4.5.4"}],"versionsText":"≤ 4.4.5.3 (fixed in 4.4.5.4)","eol":null,"hubHref":null}],"affectedCount":9,"eol":{"hasEol":false,"count":0},"references":[{"url":"https://wpscan.com/vulnerability/cda978b2-b31f-495d-8601-0aaa3e4b45cd","label":"wpscan.com/vulnerability/cda978b2-b31f-495d-8601-0aaa3e4b45cd","hostname":"wpscan.com","tags":["Exploit","Third Party Advisory"]},{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f70a2a58-d9b8-456d-ae4f-9c60b3d6b8a5","label":"www.wordfence.com/threat-intel/vulnerabilities/id/f70a2a58-d9b8-456d-ae4f-9c60b3d6b8a5","hostname":"www.wordfence.com","tags":["Vendor Advisory"]}],"lineage":{"upstream":[],"downstream":[],"duplicates":[],"related":[]},"timeline":[{"kind":"published","date":"2022-10-10T00:00:00.000Z","label":"Published","detail":"Vulnerability first disclosed.","source":null},{"kind":"modified","date":"2024-08-03T01:00:10.538Z","label":"Last modified","detail":"Vulnerability information updated.","source":null}],"risk":{"score":45,"level":"medium","profile":"Default","thresholds":{"critical":75,"high":50,"medium":25,"low":10}},"meta":{"dataAsOf":"2026-10-22T13:39:48.255Z","stale":false,"partial":false}}