2 lines
6.3 KiB
JSON
2 lines
6.3 KiB
JSON
{"affected":[{"affectedData":[{"collectionURL":"https://wordpress.org/plugins","defaultStatus":"unaffected","product":"WooCommerce","vendor":"Automattic","versions":[{"lessThan":"5.4.4","status":"affected","version":"5.4.0","versionType":"semver"},{"lessThan":"5.4.5","status":"affected","version":"5.5.0","versionType":"semver"},{"lessThan":"5.6.3","status":"affected","version":"5.6.0","versionType":"semver"},{"lessThan":"5.7.3","status":"affected","version":"5.7.0","versionType":"semver"},{"lessThan":"5.8.2","status":"affected","version":"5.8.0","versionType":"semver"},{"lessThan":"5.9.2","status":"affected","version":"5.9.0","versionType":"semver"},{"lessThan":"6.0.2","status":"affected","version":"6.0.0","versionType":"semver"},{"lessThan":"6.1.3","status":"affected","version":"6.1.0","versionType":"semver"},{"lessThan":"6.2.3","status":"affected","version":"6.2.0","versionType":"semver"},{"lessThan":"6.3.2","status":"affected","version":"6.3.0","versionType":"semver"},{"lessThan":"6.4.2","status":"affected","version":"6.4.0","versionType":"semver"},{"lessThan":"6.5.2","status":"affected","version":"6.5.0","versionType":"semver"},{"lessThan":"6.6.2","status":"affected","version":"6.6.0","versionType":"semver"},{"lessThan":"6.7.1","status":"affected","version":"6.7.0","versionType":"semver"},{"lessThan":"6.8.3","status":"affected","version":"6.8.0","versionType":"semver"},{"lessThan":"6.9.5","status":"affected","version":"6.9.0","versionType":"semver"},{"lessThan":"7.0.2","status":"affected","version":"7.0.0","versionType":"semver"},{"lessThan":"7.1.2","status":"affected","version":"7.1.0","versionType":"semver"},{"lessThan":"7.2.4","status":"affected","version":"7.2.0","versionType":"semver"},{"lessThan":"7.3.1","status":"affected","version":"7.3.0","versionType":"semver"},{"lessThan":"7.4.2","status":"affected","version":"7.4.0","versionType":"semver"},{"lessThan":"7.5.2","status":"affected","version":"7.5.0","versionType":"semver"},{"lessThan":"7.6.2","status":"affected","version":"7.6.0","versionType":"semver"},{"lessThan":"7.7.3","status":"affected","version":"7.7.0","versionType":"semver"},{"lessThan":"7.8.4","status":"affected","version":"7.8.0","versionType":"semver"},{"lessThan":"7.9.2","status":"affected","version":"7.9.0","versionType":"semver"},{"lessThan":"8.0.5","status":"affected","version":"8.0.0","versionType":"semver"},{"lessThan":"8.1.4","status":"affected","version":"8.1.0","versionType":"semver"},{"lessThan":"8.2.5","status":"affected","version":"8.2.0","versionType":"semver"},{"lessThan":"8.3.4","status":"affected","version":"8.3.0","versionType":"semver"},{"lessThan":"8.4.3","status":"affected","version":"8.4.0","versionType":"semver"},{"lessThan":"8.5.5","status":"affected","version":"8.5.0","versionType":"semver"},{"lessThan":"8.6.4","status":"affected","version":"8.6.0","versionType":"semver"},{"lessThan":"8.7.3","status":"affected","version":"8.7.0","versionType":"semver"},{"lessThan":"8.8.7","status":"affected","version":"8.8.0","versionType":"semver"},{"lessThan":"8.9.5","status":"affected","version":"8.9.0","versionType":"semver"},{"lessThan":"9.0.4","status":"affected","version":"9.0.0","versionType":"semver"},{"lessThan":"9.1.7","status":"affected","version":"9.1.0","versionType":"semver"},{"lessThan":"9.2.5","status":"affected","version":"9.2.0","versionType":"semver"},{"lessThan":"9.3.6","status":"affected","version":"9.3.0","versionType":"semver"},{"lessThan":"9.4.5","status":"affected","version":"9.4.0","versionType":"semver"},{"lessThan":"9.5.4","status":"affected","version":"9.5.0","versionType":"semver"},{"lessThan":"9.6.4","status":"affected","version":"9.6.0","versionType":"semver"},{"lessThan":"9.7.3","status":"affected","version":"9.7.0","versionType":"semver"},{"lessThan":"9.8.7","status":"affected","version":"9.8.0","versionType":"semver"},{"lessThan":"9.9.7","status":"affected","version":"9.9.0","versionType":"semver"},{"lessThan":"10.0.6","status":"affected","version":"10.0.0","versionType":"semver"},{"lessThan":"10.1.4","status":"affected","version":"10.1.0","versionType":"semver"},{"lessThan":"10.2.4","status":"affected","version":"10.2.0","versionType":"semver"},{"lessThan":"10.3.8","status":"affected","version":"10.3.0","versionType":"semver"},{"lessThan":"10.4.4","status":"affected","version":"10.4.0","versionType":"semver"},{"lessThan":"10.5.3","status":"affected","version":"10.5.0","versionType":"semver"}]}],"source":"contact@wpscan.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"The WooCommerce WordPress plugin from versions 5.4.0 to 10.5.2 does not properly handle batch requests, which could allow unauthenticated users to make a logged in admin call non store/WC REST endpoints, and create arbitrary admin users via a CSRF attack for example."},{"lang":"es","value":"El plugin de WordPress WooCommerce desde las versiones 5.4.0 hasta la 10.5.2 no gestiona correctamente las solicitudes por lotes, lo que podría permitir a usuarios no autenticados realizar una llamada de administrador autenticado a puntos finales REST que no sean de tienda/WC, y crear usuarios administradores arbitrarios a través de un ataque CSRF, por ejemplo."}],"id":"CVE-2026-3589","lastModified":"2026-06-17T10:43:49.817","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.6,"impactScore":5.9,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-3589","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-03-06T17:44:54.283745Z","version":"2.0.3"}}]},"published":"2026-03-06T10:16:22.497","references":[{"source":"contact@wpscan.com","url":"https://developer.woocommerce.com/2026/03/02/store-api-vulnerability-patched-in-woocommerce-5-4/"},{"source":"contact@wpscan.com","url":"https://wpscan.com/vulnerability/53ded097-274d-4850-82ee-620bf02f7553/"}],"sourceIdentifier":"contact@wpscan.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-352"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]}
|