1. Home
  2. CVE Database
  3. CVE-2022-36284
MEDIUM · 6.4

CVE-2022-36284

Authenticated IDOR vulnerability in StoreApps Affiliate For WooCommerce premium plugin <= 4.7.0 at WordPress allows an attacker to change the PayPal email. WooCommerce PayPal Payments plugin (free) sh...

Vulnerability Description

Authenticated IDOR vulnerability in StoreApps Affiliate For WooCommerce premium plugin <= 4.7.0 at WordPress allows an attacker to change the PayPal email. WooCommerce PayPal Payments plugin (free) should be at least installed to get the extra input field on the user profile page.

CVSS Score

6.4

MEDIUM

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:H/A:L
Attack Vector
NETWORK
Attack Complexity
HIGH
Privileges Required
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality
LOW
Integrity
HIGH
Availability
LOW

Affected Products

VendorProductVersions
StoreappsAffiliate For Woocommerce<= 4.7.0

Related Weaknesses (CWE)

CWE-639

References

FAQ

What is CVE-2022-36284?

CVE-2022-36284 is a vulnerability with a CVSS score of 6.4 (MEDIUM). Authenticated IDOR vulnerability in StoreApps Affiliate For WooCommerce premium plugin <= 4.7.0 at WordPress allows an attacker to change the PayPal email. WooCommerce PayPal Payments plugin (free) sh...

How severe is CVE-2022-36284?

CVE-2022-36284 has been rated MEDIUM with a CVSS base score of 6.4/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2022-36284?

Check the references section above for vendor advisories and patch information. Affected products include: Storeapps Affiliate For Woocommerce.