Executive Summary

This vulnerability is a Cross-Site Request Forgery (CSRF) issue in the ShopEngine Elementor WooCommerce Builder Addon plugin for WordPress, affecting all versions up to and including 4.8.5. It occurs because the plugin lacks proper nonce validation on the "post_add_to_list" function and has an incorrect permissions callback in the "Api/init" function. This allows unauthenticated attackers to trick a site's user into performing actions, such as adding or removing products from their wishlist, via a forged request.

Useful 0 Not Useful 0

Impact Analysis

The vulnerability can impact you by allowing an attacker to manipulate your wishlist without your consent. Specifically, an attacker can add or remove products from your wishlist by tricking you into clicking a malicious link. This could lead to unwanted changes in your user experience or potentially be used as part of a larger attack or manipulation strategy.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability, you should update the ShopEngine Elementor WooCommerce Builder Addon plugin to a version later than 4.8.5, as all versions up to and including 4.8.5 are vulnerable. Since the provided changeset for version 4.8.6 does not explicitly mention a fix for this vulnerability, verify with the plugin vendor or official changelog that the update addresses the issue. Additionally, consider implementing standard WordPress security practices such as limiting user permissions and educating users to avoid clicking on suspicious links to reduce the risk of Cross-Site Request Forgery attacks. [1]

Useful 0 Not Useful 0