Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2022-0775: WooCommerce < 6.2.1 - Subscriber+ Arbitrary Comment Deletion

CVE-2022-0775 · published 2 years ago

Summary

The WooCommerce WordPress plugin before 6.2.1 does not have proper authorisation check when deleting reviews, which could allow any authenticated users, such as subscriber to delete arbitrary comment

What to do

Update woocommerce woocommerce to version 6.2.1 or later.

Affected software

Vendor	Product	Affected versions
woocommerce	woocommerce	< 6.2.1 `cpe:2.3:a:woocommerce:woocommerce::::::wordpress::*`

Original advisory text

WooCommerce < 6.2.1 - Subscriber+ Arbitrary Comment Deletion

The WooCommerce WordPress plugin before 6.2.1 does not have proper authorisation check when deleting reviews, which could allow any authenticated users, such as subscriber to delete arbitrary comment

References

https://wordpress.org/plugins URL
https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/0xxx/CVE-2022-0775.j... Vendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2022-0775 Vendor Advisory
https://developer.woocommerce.com/2022/02/22/woocommerce-6-2-1-security-fix/ URL
https://plugins.trac.wordpress.org/changeset/2683324 Patch
https://wpscan.com/vulnerability/b76dbf37-a0a2-48cf-bd85-3ebbc2f394dd/ Exploit

Fix within

Internet-facing 60 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit
Gives an attacker partial control

Severity

4.3 Medium

Exploitation

<1% chance of attack within 30 days

Type

CWE-863Incorrect Authorization

Timeline

Published16 Jan 2024

Updated4 Nov 2026

First seen29 Sep 2026

Sources

CVE-2022-0775 · NVD

CVE-2022-0775 · OSV

Track software like this

Free during beta