CVE-2021-4337: xforwoocommerce add product tabs +15 lainnya…

csirt@kutim:~/threat-intel/cve/CVE-2021-4337

CVSS 8.8 · High EPSS 1,3%

Kerentanan Missing Authorization pada xforwoocommerce add product tabs, xforwoocommerce autopilot seo +14 lainnya. Skor CVSS 3.1 8.8 (High) menurut NVD.

Deskripsi (NVD)

Sixteen XforWooCommerce Add-On Plugins for WordPress are vulnerable to authorization bypass due to a missing capability check on the wp_ajax_svx_ajax_factory function in various versions listed below. This makes it possible for authenticated attackers, with subscriber-level permissions and above, to read, edit, or delete WordPress settings, plugin settings, and to arbitrarily list all users on a WordPress website. The plugins impacted are: Product Filter for WooCommerce < 8.2.0, Improved Product Options for WooCommerce < 5.3.0, Improved Sale Badges for WooCommerce < 4.4.0, Share, Print and PDF Products for WooCommerce < 2.8.0, Product Loops for WooCommerce < 1.7.0, XforWooCommerce < 1.7.0, Package Quantity Discount < 1.2.0, Price Commander for WooCommerce < 1.3.0, Comment and Review Spam Control for WooCommerce < 1.5.0, Add Product Tabs for WooCommerce < 1.5.0, Autopilot SEO for WooCommerce < 1.6.0, Floating Cart < 1.3.0, Live Search for WooCommerce < 2.1.0, Bulk Add to Cart for WooCommerce < 1.3.0, Live Product Editor for WooCommerce < 4.7.0, and Warranties and Returns for WooCommerce < 5.3.0.

Rincian

Terbit di NVD: 7 Juni 2023
Terakhir diubah: 17 Juni 2026
Status NVD: Modified
CVSS 3.1: 8.8 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator
Jenis kelemahan (CWE): CWE-862: Missing Authorization
EPSS (30 hari): 1,3% peluang dieksploitasi; lebih tinggi dari 69,1% CVE lain

Produk dan versi terdampak

Vendor	Produk	Versi terdampak
xforwoocommerce	add product tabs	Semua versi sebelum 1.5.0
xforwoocommerce	autopilot seo	Semua versi sebelum 1.6.0
xforwoocommerce	bulk add to cart	Semua versi sebelum 1.3.0
xforwoocommerce	comment and review spam control	Semua versi sebelum 1.5.0
xforwoocommerce	floating cart	Semua versi sebelum 1.3.0
xforwoocommerce	improved product options	Semua versi sebelum 5.3.0
xforwoocommerce	improved sale badges	Semua versi sebelum 4.4.0
xforwoocommerce	live product editor	Semua versi sebelum 4.7.0
xforwoocommerce	live search	Semua versi sebelum 2.1.0
xforwoocommerce	package quantity	Semua versi sebelum 1.2.0
xforwoocommerce	price commander	Semua versi sebelum 1.3.0
xforwoocommerce	product filter	Semua versi sebelum 8.2.0
xforwoocommerce	product loops	Semua versi sebelum 1.7.0
xforwoocommerce	share, print and pdf products	Semua versi sebelum 2.8.0
xforwoocommerce	warranties and returns	Semua versi sebelum 5.3.0
xforwoocommerce	xforwoocommerce	Semua versi sebelum 1.7.0

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

https://xforwoocommerce.com/blog/change-log/xforwoocommerce-1-7-0/ advisory vendor
https://blog.nintechnet.com/16-woocommerce-product-add-ons-plugins-fixed-vulnerabilities/ exploit · advisory pihak ketiga
https://www.wordfence.com/threat-intel/vulnerabilities/id/05481984-7c18-4ec7-8d7c-831809c3e86b?source=cve advisory pihak ketiga

Sumber: NVD · CVE.org · EPSS. Halaman ini disusun otomatis dari data tersebut; pembaruan terakhir 5 Okt 2026, 20:10 WITA. Kalau sistem di Perangkat Daerah memakai produk ini dan butuh bantuan, laporkan lewat kanal pelaporan.