CVE-2022-3999

8.1 highEPSS 0.4%

High (8.1) in dpdgroup woocommerce shipping. EPSS 0.4% chance of exploitation in the next 30 days.

The DPD Baltic Shipping WordPress plugin before 1.2.57 does not have authorisation and CSRF in an AJAX action, which could allow any authenticated users, such as subscriber to delete arbitrary options from the blog, which could make the blog unavailable.

Severity

CVSS 3.1

8.1 high

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

EPSS: 0.4% chance of exploitation in the next 30 days; higher than 38% of CVEs (scores of 2026-10-31)
CWEs: CWE-352, CWE-862
Published: 2022-12-12
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

dpdgroup:woocommerce_shipping

References

https://wpscan.com/vulnerability/625ae924-68db-4579-a34f-e6f33aa33643
https://wpscan.com/vulnerability/625ae924-68db-4579-a34f-e6f33aa33643

Check your stack JSON