What’s Vulnerable › Vulnerabilities

CVE-2022-3999: WooCommerce Shipping - DPD baltic < 1.2.57 - Subscriber+ Arbitrary Options Deletion

• Severity: high (CVSS 8.1 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.4% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2022-12-12 · updated 2026-06-17
• Weakness: CWE-352

Description

The DPD Baltic Shipping WordPress plugin before 1.2.57 does not have authorisation and CSRF in an AJAX action, which could allow any authenticated users, such as subscriber to delete arbitrary options from the blog, which could make the blog unavailable.

Affected products

• DPD Baltic Shipping: through 1.2.11

References

• https://wpscan.com/vulnerability/625ae924-68db-4579-a34f-e6f33aa33643
• https://wpscan.com/vulnerability/625ae924-68db-4579-a34f-e6f33aa33643

Get alerted when CVE-2022-3999 or the next vulnerability affects your stack