CVE Database /
CVE-2019-15841
CVE · High
CVE-2019-15841 — Meta for WooCommerce [facebook-for-woocommerce] < 1.9.15
| CVE |
Vulnerability |
Type |
Severity |
Affected |
Fixed in |
Published |
Status |
|
CVE-2019-15841, CVE-2019-15840
|
Meta for WooCommerce [facebook-for-woocommerce] < 1.9.15 |
Cross-Site Request Forgery (CSRF) |
High
8.8
|
< 1.9.15
|
1.9.15 |
2019-06-18 |
—
|
CVE-2019-15841, CVE-2019-15840
The facebook-for-woocommerce plugin in versions prior to 1.9.15 contains cross-site request forgery vulnerabilities in three AJAX endpoints: ajax_woo_infobanner_post_click, ajax_woo_infobanner_post_xout, and ajax_fb_toggle_visibility. These endpoints lack proper nonce validation, allowing attackers to perform unauthorized actions on behalf of authenticated users. The vulnerability affects all versions before 1.9.15, with the flaw being resolved in version 1.9.15 and later.
Based on public CVE data (MITRE/NVD).
Scan your WordPress site free
No signup, no credit card — enter your URL and get a security report in seconds.
See the full security page for this plugin
Browse the CVE database
Browse all security findings