Quick answers
- Is CVE-2022-44630 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2022-44630 being exploited in the wild.
- How severe is CVE-2022-44630?
- Medium severity, with a CVSS score of 4.6, published 11 June 2026.
- Which products and versions are affected?
- YITH WooCommerce Product Slider Carousel <= 1.16.0.
- Is there a fix for CVE-2022-44630?
- A patch was published on 2023-03-03: Version 1.16.1 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2022-44630 attacked?
- It is attacked over the network, in a software library.
- Am I affected by CVE-2022-44630?
- Check whether you run YITH WooCommerce Product Slider Carousel at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
A Cross-Site Request Forgery (CSRF) vulnerability exists in the YITH WooCommerce Product Slider Carousel plugin for WordPress (versions <= 1.16.0). The issue stems from a lack of proper nonce validation on sensitive administrative actions. An attacker can exploit this by crafting a malicious request and tricking a privileged user into executing it via social engineering (e.g., a malicious link). Successful exploitation allows the attacker to perform unauthorized actions with the permissions of the victim user, such as modifying plugin settings. The vulnerability is addressed in version 1.16.1.
Affected products
- YITH YITH WooCommerce Product Slider Carousel <= 1.16.0
Timeline
- 2022-11-02: disclosed: Reported by István Márton
- 2023-03-03: advisory: Patchstack published advisory
- 2023-03-03: patched: Version 1.16.1 released