CVE-2022-3946: unknown welcart e-commerce Cross-Site Request Forgery (CSRF)
CVSS: 6.5v3.1MediumModified
Published 12-12-2022Last modified 22-04-2025
Vulnerability summary
CVE-2022-3946 is a medium (CVSS 6.5) Cross-Site Request Forgery (CSRF) vulnerability in unknown welcart e-commerce. EPSS estimates a 0.34% chance of exploitation in the next 30 days, higher than 26.5% of scored vulnerabilities. 1 public exploit is recorded. Fixed in 2.8.4.
CVSS score
6.5/10
010
Medium · v3.1 (CVE.org)EPSS score
0.34%
0%100%
Low · +0.02 pp in 30 daysKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits1reference
Timeline
- 12-12-2022PublishedVulnerability first disclosed.
- 22-04-2025Last modifiedVulnerability information updated.
Description
The Welcart e-Commerce WordPress plugin before 2.8.4 does not have authorisation and CSRF in an AJAX action, allowing any logged-in user to create, update and delete shipping methods.
CVSS metrics
3 scores · 3 sources · 1 versionMedium 6.5Preferred score · CVE.org (CNA)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:NSources3 sources · 5.4–6.5
- NVDNIST6.5MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
- wordfenceSource5.4MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:NDiffers
EPSS trend
Probability
0.34%
Chance of exploitation in the next 30 days
Percentile
27%
Versus all other CVEs
30-day change
+0.02 pp
From 0.33% on 18-09-2026
18-09-202618-10-2026
EPSS score0.34%
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
1 foundExploit Reference (wpscan.com)
Maturity: unknown
Weaknesses
CWE · root cause- CWE-352Cross-Site Request Forgery (CSRF)The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor.
- CWE-862Missing AuthorizationThe product does not perform an authorization check when an actor attempts to access a resource or perform an action.
Affected systems
Unknown1 product
- welcart e-commerce< 2.8.4
Welcart1 product
- welcart_e-commerce< 2.8.4
Wordpress1 product
- usc-e-shop≤ 2.8.3 (fixed in 2.8.4)
3 vendors · 3 products
References
2 links- wpscan.com/vulnerability/b48e4e1d-e682-4b16-81dc-2feee78d7ed0ExploitVDB EntryTechnical DescriptionThird Party Advisory