CVE-2022-4426: Mautic Integration For WooCommerce < 1.0.3 - Arbitrary Options Update via CSRF

Severity: medium (CVSS 4.3 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2023-01-09 · updated 2026-06-17

Description

The Mautic Integration for WooCommerce WordPress plugin before 1.0.3 does not have proper CSRF check when updating settings, and does not ensure that the options to be updated belong to the plugin, allowing attackers to make a logged in admin change arbitrary blog options via a CSRF attack.

Affected products

Mautic Integration for WooCommerce: before 1.0.3 — fixed in 1.0.3

How to fix

Upgrade to a fixed version: Mautic Integration for WooCommerce 1.0.3. Check the vendor advisory for mitigations.

References

https://wpscan.com/vulnerability/7d3d6b9c-d1c1-4e23-b891-7c72e4e89c38
https://wpscan.com/vulnerability/7d3d6b9c-d1c1-4e23-b891-7c72e4e89c38

Get alerted when CVE-2022-4426 or the next vulnerability affects your stack