CVE-2024-13511 Details
Description
The Variation Swatches for WooCommerce plugin, in all versions starting at 1.0.8 up until 1.3.2, contains a vulnerability due to improper nonce verification in its settings reset functionality. The issue exists in the settings_init() function, which processes a reset action based on specific query parameters in the URL. The related delete_settings() function performs a faulty nonce validation check, making the reset operation insecure and susceptible to unauthorized access.
A Cross-Site Request Forgery (CSRF) vulnerability has been identified in the Variation Swatches for WooCommerce plugin, affecting versions 1.0.8 prior to 1.3.2. The vulnerability arises from inadequate nonce verification in the plugin's settings reset feature. Specifically, the issue is located in the settings_init() function, which handles reset actions based on certain query parameters in the URL. The associated delete_settings() function fails to properly validate nonces, rendering the reset process insecure and open to unauthorized access.
Users are advised to update the Variation Swatches for WooCommerce plugin to version 1.3.3 or a newer patched version.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jan 23, 2025References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-352 | Cross-Site Request Forgery (CSRF) | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| variation swatches for woocommerce project variation swatches for woocommerce | >= 1.0.8, < 1.3.3 |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Feb 5, 2025 | Initial Analysis | [email protected] |
| Jan 23, 2025 | New CVE Received | [email protected] |