CVE-2022-0215 XootiX Plugins <= Various Versions Cross-Site Request Forgery to Arbitrary Options Update
Cross-site request forgery in XootiX WordPress plugins allows attackers to update settings and create admin accounts, leading to full site compromise.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2022-0215?
CVE-2022-0215 is a high-severity vulnerability in XootiX Login/Signup Popup, published on 18 Jan 2022. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
The Login/Signup Popup, Waitlist Woocommerce ( Back in stock notifier ), and Side Cart Woocommerce (Ajax) WordPress plugins by XootiX are vulnerable to Cross-Site Request Forgery via the save_settings function found in the ~/includes/xoo-framework/admin/class-xoo-admin-settings.php file which makes it possible for attackers to update arbitrary options on a site that can be used to create an administrative user account and grant full privileged access to a compromised site. This affects versions <= 2.2 in Login/Signup Popup, versions <= 2.5.1 in Waitlist Woocommerce ( Back in stock notifier ), and versions <= 2.0 in Side Cart Woocommerce (Ajax).
Weakness: CWE-352
Which versions are affected by CVE-2022-0215?
It affects 3 products.
Products include Xootix Login\/Signup Popup, Xootix Side Cart Woocommerce, Xootix Waitlist Woocommerce.
How do I fix CVE-2022-0215?
No fix has been published for CVE-2022-0215 yet. Limit exposure of the affected software until one is available.
Is CVE-2022-0215 being exploited?
There is no known exploitation of CVE-2022-0215 in the wild and no public exploit code.
Other vulnerabilities in XootiX Login/Signup Popup
- CVE-2024-5324 XootiX Framework <= Various Plugin Versions - Missing Authorization to Arbitrary Options Update
- CVE-2020-36715 Login/Signup Popup < 1.5 - Missing Authorization
- CVE-2025-1064 Cross-site scripting in Login & Register Customizer – Popup | Slider | Inline | WooCommerce
- CVE-2024-5665 Login/Signup Popup ( Inline Form + Woocommerce ) 2.7.1 - 2.7.2 - Missing Authorization to Arbitrary Options Exposure
Sources
Also known as GHSA-824x-r58x-c6fc.