Medium severity4.3NVD Advisory· Published Jun 9, 2023· Updated Apr 8, 2026

CVE-2023-2894

Description

The WP EasyCart plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 5.4.8. This is due to missing or incorrect nonce validation on the process_bulk_deactivate_product function. This makes it possible for unauthenticated attackers to bulk deactivate products via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Wpeasycart/Wp Easycart
cpe:2.3:a:wpeasycart:wp_easycart:*:*:*:*:*:wordpress:*:*
Range: <=5.4.8
WordPress/Wp Easycartllm-fuzzy
Range: <=5.4.8
Package: https://wordpress.org/plugins/wp-easycart

Patches

Vulnerability mechanics

References

plugins.trac.wordpress.org/changeset/2917958/wp-easycartnvdPatch
www.wordfence.com/threat-intel/vulnerabilities/id/a68b8df9-9b50-4617-9308-76a2a9036d7anvdThird Party Advisory

News mentions

No linked articles in our index yet.

cvss	0.280
epss	0.000
exploit	0.000
kev	0.000
patch	-0.070
ransomware	0.000