CVE-2022-2389

The Abandoned Cart Recovery for WooCommerce, Follow Up Emails, Newsletter Builder & Marketing Automation By Autonami WordPress plugin before 2.1.2 does not have authorisation and CSRF checks in one of its AJAX action, allowing any authenticated users, such as subscriber to create automations

CVSS v3.1

4.3 MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

EPSS

0.36% chance of exploitation in the next 30 days, 29th percentile

Published

2022-08-22

Updated

2024-08-03

Proof-of-concept exploits (1)

• https://wpscan.com/vulnerability/e70f00b7-6251-476e-9297-60af509e6ad9

References

• CVE Record
• NVD entry

Related

• CVE-2022-23888
• CVE-2022-23896
• CVE-2022-23887
• CVE-2022-23898
• CVE-2022-23884
• CVE-2022-23899