Medium severity · published Oct 31, 2019
CVE-2019-16251
plugin-fw/lib/yit-plugin-panel-wc.php in the YIT Plugin Framework through 3.3.8 for WordPress allows authenticated options changes
4.3
CVSS
0.9%
EPSS
No
On KEV
Description
plugin-fw/lib/yit-plugin-panel-wc.php in the YIT Plugin Framework through 3.3.8 for WordPress allows authenticated options changes.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
None
Integrity
Low
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.9% · higher than 61% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
YA
Yith Advanced Refund System For Woocommerce · Yithemes
through 1.0.10 · source: NVD
YC
Yith Color And Label Variations For Woocommerce · Yithemes
through 1.8.11 · source: NVD
YC
Yith Custom Thank You Page For Woocommerce · Yithemes
through 1.1.6 · source: NVD
YD
Yith Desktop Notifications For Woocommerce · Yithemes
through 1.2.7 · source: NVD
YP
Yith Paypal Express Checkout For Woocommerce · Yithemes
through 1.2.5 · source: NVD
YP
Yith Pre-order For Woocommerce · Yithemes
through 1.1.9 · source: NVD
YP
Yith Product Size Charts For Woocommerce · Yithemes
through 1.1.1 · source: NVD
YW
Yith Woocommerce Added TO Cart Popup · Yithemes
through 1.3.11 · source: NVD
YW
Yith Woocommerce Advanced Reviews · Yithemes
through 1.3.9 · source: NVD
YW
Yith Woocommerce Affiliates · Yithemes
through 1.6.3 · source: NVD
YW
Yith Woocommerce Ajax Search · Yithemes
through 1.6.9 · source: NVD
YW
Yith Woocommerce Authorize.net Payment Gateway · Yithemes
through 1.1.12 · source: NVD
Affected product
YA
Yith Advanced Refund System For Woocommerce
Yithemes