CVE-2023-5979: eCommerce Product Catalog Plugin for WordPress < 3.3.26 - Products Deletion via CSRF

Severity: medium (CVSS 6.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2023-12-04 · updated 2026-06-17
Weakness: CWE-352

Description

The eCommerce Product Catalog Plugin for WordPress plugin before 3.3.26 does not have CSRF checks in some of its admin pages, which could allow attackers to make logged-in users perform unwanted actions via CSRF attacks, such as delete all products

Affected products

impleCode eCommerce Product Catalog: before 3.3.26 — fixed in 3.3.26

How to fix

Upgrade to a fixed version: impleCode eCommerce Product Catalog 3.3.26. Check the vendor advisory for mitigations.

References

https://wpscan.com/vulnerability/936934c3-5bfe-416e-b6aa-47bed4db05c4
https://wpscan.com/vulnerability/936934c3-5bfe-416e-b6aa-47bed4db05c4

Get alerted when CVE-2023-5979 or the next vulnerability affects your stack