Anonymous User 20889438
(@anonymized-20889438)
@orfevre13, CSRF vulnerability cannot be critical in the first place. The original source – Patchstack – marked this vulnerability as “medium” which is more legit.
Fear is big business.
You are right, medium but it still has a security vulnerability with a possible serious harm. For the moment I prefer deactivate and delete this plug-in, please fix this vulnerability as soon as possible. thank you
When will this be addressed?
I concur, would be good to know when a ‘fix’ might be forthcoming for this?
Plugin Author
xootix
(@xootix)
I don’t know how it is marked as a critical security issue.
As per their detection, the following situation will result in a hack
1) You’re logged in as an admin
2) Someone makes you visit this specific link
http://www.yourwebsite.com/wp-admin/admin.php?page=side-cart-woocommerce-settings&reset=yes
=> The consequence of this will be your side cart settings will get reset which is basically what “reset button” does now.
Still I will issue a patch tomorrow.
Many thanks @xootix
I’m sure there was an element of WF being somewhat over zealous regards this alert, but I’m sure I speak for everyone when I say I would rather the risk not be there at all.
Thanks again for your swift action 😊
I agree, looking forward to the patch, even if minor, so it is not being flagged and clients aren’t panicking.
<font _mstmutation=”1″></font>I agree, looking forward to the patch
Unfortunately our site is still flagging the plugin as having a critical security vulnerability:
“WordPress Side Cart Woocommerce (Ajax) plugin <= 2.1 – Cross-Site Request Forgery (CSRF) vulnerability“
Has any patch been implemented yet? Thanks 👍
Hello! Thank you for your work on this! Much appreciated.
I am using version 2.1 and iThemes security is still flagging the plugin with a vulnerability.
WordPress Side Cart Woocommerce (Ajax) plugin <= 2.1 – Cross-Site Request Forgery (CSRF) vulnerability
Thanks again!- scott
Plugin Author
xootix
(@xootix)
Hello,
I’ve fixed this in the current version. Will soon release the new version.
You can delete and reinstall the plugin or wait for the new version.
The patchstack initially reported this and they have marked it as “fixed”
https://patchstack.com/database/vulnerability/side-cart-woocommerce/wordpress-side-cart-woocommerce-ajax-plugin-2-1-cross-site-request-forgery-csrf-vulnerability
Please do not worry, this vulnerability can do nothing to your site. They just mark everything as vulnerable and scare users for nothing.
If you’re logged in as an admin and if someone asks you to visit a specific link
http://www.yourwebsite.com/wp-admin/admin.php?page=side-cart-woocommerce-settings&reset=yes
It will reset your side cart settings to default
How vulnerable is this to be given a 8.8 level threat?
Thanks @xootix
Your help is much appreciated!
Hello all, this is Robert from Patchstack.
Foremost, thank you to @xootix for writing and pushing the patch. CSRF bugs are rarely targeted in the wild, but the patch makes your project more complete. Patchstack has updated our records to show this plugin is patched and safe to use.
Regarding WordFence’s “critical” severity claim. Only WordFence can controls their choice of words. This is not the first case where they take a Low or Medium severity risk, and claim it is “critical” to their customers. It is not fair for me to speculate as to why they did this, however I feel I am in agreement with most of the posters here like (@twostrong @espressivo @fearzzzz and @orfevre13) that this critical warning caused undue stress for the users of this plugin who has an attentive developer working on the patch. if you’re interested in clearer security communication, well, maybe look into us.
If anyone has any questions on Patchstack’s process of receiving security bugs from third parties and how we score them, please feel free to reach out. I’ll turn on notifications for this thread.
Have a wonderful day. – Robert
Hello! It would be great to have a plugin version bump so that we can stop getting the patched 2.1 version flagged as insecure by plugins like Wordfence.
Regards,
Lautaro.
