CVE Catalog
CVE-2023-3366
MediumCVSS 4.3Exploitation Probability (EPSS)
Low risk0.23%
14th percentile - higher than 14% of all known CVEs
Summary
The MultiParcels Shipping For WooCommerce plugin before version 1.15.2 lacks CSRF verification when deleting a shipment, allowing attackers to delete arbitrary shipments via a CSRF attack by any logged-in user.
Risk Assessment
The lack of CSRF verification poses a risk that malicious users can delete shipments, potentially leading to data loss and disruption of operations.
Recommendation
It is recommended to update the plugin to the latest version 1.15.2 or newer to protect against this type of attack.
Original NVD description (English source)
The MultiParcels Shipping For WooCommerce WordPress plugin before 1.15.2 does not have CRSF check when deleting a shipment, allowing attackers to make any logged in user, delete arbitrary shipment via a CSRF attack