CVE-2023-0503

Free WooCommerce Theme 99fy Extension < 1.2.8 - Arbitrary Plugin Activation via CSRF

The Free WooCommerce Theme 99fy Extension WordPress plugin before 1.2.8 does not have CSRF check when activating plugins, which could allow attackers to make logged in admins activate arbitrary plugins present on the blog via a CSRF attack

Affected

Free WooCommerce Theme 99fy Extension

CVSS v3.1 NVD

4.3 MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

EPSS

0.25% chance of exploitation in the next 30 days, 16th percentile

Published

2023-03-27

Updated

2025-02-19

Proof-of-concept exploits (1)

• https://wpscan.com/vulnerability/3cb148fb-1f30-4316-a421-10da51d849f3

References

• CVE Record
• NVD entry