CVE-2022-4936

Name of the Vulnerable Software and Affected Versions WCFM Marketplace plugin for WordPress versions up to and including 3.4.11

Description The issue allows unauthenticated attackers to perform various actions, such as modifying shipping method details, modifying products, and deleting arbitrary posts, by tricking a site's administrator into performing an action like clicking on a link. This is possible due to missing nonce checks on various AJAX actions.

Recommendations For versions up to and including 3.4.11, update to a version that includes nonce checks on AJAX actions to prevent Cross-Site Request Forgery.