GHSA-rcmf-88p4-9wrg

WooCommerce Cross-Site Request Forgery (CSRF)

Source: GitHub Advisory Database (reviewed) High CVE-2019-20891

Packages

Ecosystem	Package	Affected	Fixed in
Packagist	woocommerce/woocommerce	< 3.6.5	3.6.5

Details

As written in the advisory (Markdown source, shown as plain text).

WooCommerce before 3.6.5, when it handles CSV imports of products, has a cross-site request forgery (CSRF) issue with resultant stored cross-site scripting (XSS) via `includes/admin/importers/class-wc-product-csv-importer-controller.php`.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2019-20891 advisory
https://github.com/woocommerce/woocommerce/commit/fd7feb778eb45a2eb92b45eb2b4ee96ea3ac6fe7 web
https://blog.ripstech.com/2019/woocommerce-csrf-to-stored-xss web
https://github.com/woocommerce/woocommerce package
https://raw.githubusercontent.com/woocommerce/woocommerce/master/CHANGELOG.txt web