CVE-2022-34868 - Vulnerability Details - OpenCVE

Authenticated Arbitrary Settings Update vulnerability in YooMoney ЮKassa для WooCommerce plugin <= 2.3.0 at WordPress.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00566.

Exploitation none

Automatable no

Technical Impact total

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

YooMoney

ЮKassa для WooCommerce (WordPress plugin)

affected

Version	Status	Constraints
`<= 2.3.0`	affected	≤ 2.3.0

Configuration 1 [-]

cpe:2.3:a:yookassa:yukassa_for_woocommerce:*:*:*:*:*:wordpress:*:*

No data.

No data.

Project Subscriptions

Vendors	Products
Yookassa Subscribe	Yukassa For Woocommerce Subscribe

Advisories

Source	ID	Title
EUVD	EUVD-2022-37773	Authenticated Arbitrary Settings Update vulnerability in YooMoney ЮKassa для WooCommerce plugin <= 2.3.0 at WordPress.

Fixes

Solution

Update to 2.3.1 or higher version.

Workaround

No workaround given by the vendor.

References

Link	Providers
https://patchstack.com/database/vulnerability/yookassa/wordpress-yukassa-dlya-woocommerce-plugin-2-3-0-authenticated-arbitrary-settings-update-vulnerability
https://wordpress.org/plugins/yookassa/#developers

History

Tue, 28 Apr 2026 19:15:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

Projects

Sign in to view the affected projects.

MITRE

Status: PUBLISHED

Assigner: Patchstack

Published: 2022-08-23T15:46:07.568Z

Updated: 2026-04-28T16:07:44.675Z

Reserved: 2022-07-22T00:00:00.000Z

Link: CVE-2022-34868

Vulnrichment

Updated: 2024-08-03T09:22:10.628Z

NVD

Status : Modified

Published: 2022-08-23T16:15:10.633

Modified: 2024-11-21T07:10:20.183

Link: CVE-2022-34868

Redhat

No data.

OpenCVE Enrichment

No data.

Weaknesses

{"containers": {"cna": {"affected": [{"product": "\u042eKassa \u0434\u043b\u044f WooCommerce (WordPress plugin)", "vendor": "YooMoney", "versions": [{"lessThanOrEqual": "2.3.0", "status": "affected", "version": "<= 2.3.0", "versionType": "custom"}]}], "credits": [{"lang": "en", "value": "Vulnerability discovered by ptsfence (Patchstack Alliance)"}], "datePublic": "2022-07-29T00:00:00.000Z", "descriptions": [{"lang": "en", "value": "Authenticated Arbitrary Settings Update vulnerability in YooMoney \u042eKassa \u0434\u043b\u044f WooCommerce plugin <= 2.3.0 at WordPress."}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}}], "problemTypes": [{"descriptions": [{"cweId": "CWE-264", "description": "CWE-264 Permissions, Privileges, and Access Controls", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "21595511-bba5-4825-b968-b78d1f9984a3", "shortName": "Patchstack", "dateUpdated": "2026-04-28T16:07:44.675Z"}, "references": [{"tags": ["x_refsource_CONFIRM"], "url": "https://patchstack.com/database/vulnerability/yookassa/wordpress-yukassa-dlya-woocommerce-plugin-2-3-0-authenticated-arbitrary-settings-update-vulnerability"}, {"tags": ["x_refsource_CONFIRM"], "url": "https://wordpress.org/plugins/yookassa/#developers"}], "solutions": [{"lang": "en", "value": "Update to 2.3.1 or higher version."}], "source": {"discovery": "EXTERNAL"}, "title": "WordPress \u042eKassa \u0434\u043b\u044f WooCommerce plugin <= 2.3.0 - Authenticated Arbitrary Settings Update vulnerability", "x_generator": {"engine": "Vulnogram 0.0.9"}, "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "audit@patchstack.com", "DATE_PUBLIC": "2022-07-29T20:42:00.000Z", "ID": "CVE-2022-34868", "STATE": "PUBLIC", "TITLE": "WordPress \u042eKassa \u0434\u043b\u044f WooCommerce plugin <= 2.3.0 - Authenticated Arbitrary Settings Update vulnerability"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "\u042eKassa \u0434\u043b\u044f WooCommerce (WordPress plugin)", "version": {"version_data": [{"version_affected": "<=", "version_name": "<= 2.3.0", "version_value": "2.3.0"}]}}]}, "vendor_name": "YooMoney"}]}}, "credit": [{"lang": "eng", "value": "Vulnerability discovered by ptsfence (Patchstack Alliance)"}], "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "Authenticated Arbitrary Settings Update vulnerability in YooMoney \u042eKassa \u0434\u043b\u044f WooCommerce plugin <= 2.3.0 at WordPress."}]}, "generator": {"engine": "Vulnogram 0.0.9"}, "impact": {"cvss": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "CWE-264 Permissions, Privileges, and Access Controls"}]}]}, "references": {"reference_data": [{"name": "https://patchstack.com/database/vulnerability/yookassa/wordpress-yukassa-dlya-woocommerce-plugin-2-3-0-authenticated-arbitrary-settings-update-vulnerability", "refsource": "CONFIRM", "url": "https://patchstack.com/database/vulnerability/yookassa/wordpress-yukassa-dlya-woocommerce-plugin-2-3-0-authenticated-arbitrary-settings-update-vulnerability"}, {"name": "https://wordpress.org/plugins/yookassa/#developers", "refsource": "CONFIRM", "url": "https://wordpress.org/plugins/yookassa/#developers"}]}, "solution": [{"lang": "en", "value": "Update to 2.3.1 or higher version."}], "source": {"discovery": "EXTERNAL"}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-03T09:22:10.628Z"}, "title": "CVE Program Container", "references": [{"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://patchstack.com/database/vulnerability/yookassa/wordpress-yukassa-dlya-woocommerce-plugin-2-3-0-authenticated-arbitrary-settings-update-vulnerability"}, {"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://wordpress.org/plugins/yookassa/#developers"}]}, {"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-02-20T19:17:38.028469Z", "id": "CVE-2022-34868", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-02-20T20:12:03.267Z"}}]}, "cveMetadata": {"assignerOrgId": "21595511-bba5-4825-b968-b78d1f9984a3", "assignerShortName": "Patchstack", "cveId": "CVE-2022-34868", "datePublished": "2022-08-23T15:46:07.568Z", "dateReserved": "2022-07-22T00:00:00.000Z", "dateUpdated": "2026-04-28T16:07:44.675Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.2"}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://patchstack.com/database/vulnerability/yookassa/wordpress-yukassa-dlya-woocommerce-plugin-2-3-0-authenticated-arbitrary-settings-update-vulnerability", "tags": ["x_refsource_CONFIRM", "x_transferred"]}, {"url": "https://wordpress.org/plugins/yookassa/#developers", "tags": ["x_refsource_CONFIRM", "x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-03T09:22:10.628Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2022-34868", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2025-02-20T19:17:38.028469Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-02-20T19:17:39.564Z"}}], "cna": {"title": "WordPress \u042eKassa \u0434\u043b\u044f WooCommerce plugin <= 2.3.0 - Authenticated Arbitrary Settings Update vulnerability", "source": {"discovery": "EXTERNAL"}, "credits": [{"lang": "en", "value": "Vulnerability discovered by ptsfence (Patchstack Alliance)"}], "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.8, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}}], "affected": [{"vendor": "YooMoney", "product": "\u042eKassa \u0434\u043b\u044f WooCommerce (WordPress plugin)", "versions": [{"status": "affected", "version": "<= 2.3.0", "versionType": "custom", "lessThanOrEqual": "2.3.0"}]}], "solutions": [{"lang": "en", "value": "Update to 2.3.1 or higher version."}], "datePublic": "2022-07-29T00:00:00.000Z", "references": [{"url": "https://patchstack.com/database/vulnerability/yookassa/wordpress-yukassa-dlya-woocommerce-plugin-2-3-0-authenticated-arbitrary-settings-update-vulnerability", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://wordpress.org/plugins/yookassa/#developers", "tags": ["x_refsource_CONFIRM"]}], "x_generator": {"engine": "Vulnogram 0.0.9"}, "descriptions": [{"lang": "en", "value": "Authenticated Arbitrary Settings Update vulnerability in YooMoney \u042eKassa \u0434\u043b\u044f WooCommerce plugin <= 2.3.0 at WordPress."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-264", "description": "CWE-264 Permissions, Privileges, and Access Controls"}]}], "providerMetadata": {"orgId": "21595511-bba5-4825-b968-b78d1f9984a3", "shortName": "Patchstack", "dateUpdated": "2026-04-28T16:07:44.675Z"}, "x_legacyV4Record": {"credit": [{"lang": "eng", "value": "Vulnerability discovered by ptsfence (Patchstack Alliance)"}], "impact": {"cvss": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.8, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}}, "source": {"discovery": "EXTERNAL"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"version": {"version_data": [{"version_name": "<= 2.3.0", "version_value": "2.3.0", "version_affected": "<="}]}, "product_name": "\u042eKassa \u0434\u043b\u044f WooCommerce (WordPress plugin)"}]}, "vendor_name": "YooMoney"}]}}, "solution": [{"lang": "en", "value": "Update to 2.3.1 or higher version."}], "data_type": "CVE", "generator": {"engine": "Vulnogram 0.0.9"}, "references": {"reference_data": [{"url": "https://patchstack.com/database/vulnerability/yookassa/wordpress-yukassa-dlya-woocommerce-plugin-2-3-0-authenticated-arbitrary-settings-update-vulnerability", "name": "https://patchstack.com/database/vulnerability/yookassa/wordpress-yukassa-dlya-woocommerce-plugin-2-3-0-authenticated-arbitrary-settings-update-vulnerability", "refsource": "CONFIRM"}, {"url": "https://wordpress.org/plugins/yookassa/#developers", "name": "https://wordpress.org/plugins/yookassa/#developers", "refsource": "CONFIRM"}]}, "data_format": "MITRE", "description": {"description_data": [{"lang": "eng", "value": "Authenticated Arbitrary Settings Update vulnerability in YooMoney \u042eKassa \u0434\u043b\u044f WooCommerce plugin <= 2.3.0 at WordPress."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "CWE-264 Permissions, Privileges, and Access Controls"}]}]}, "data_version": "4.0", "CVE_data_meta": {"ID": "CVE-2022-34868", "STATE": "PUBLIC", "TITLE": "WordPress \u042eKassa \u0434\u043b\u044f WooCommerce plugin <= 2.3.0 - Authenticated Arbitrary Settings Update vulnerability", "ASSIGNER": "audit@patchstack.com", "DATE_PUBLIC": "2022-07-29T20:42:00.000Z"}}}}, "cveMetadata": {"cveId": "CVE-2022-34868", "state": "PUBLISHED", "dateUpdated": "2026-04-28T16:07:44.675Z", "dateReserved": "2022-07-22T00:00:00.000Z", "assignerOrgId": "21595511-bba5-4825-b968-b78d1f9984a3", "datePublished": "2022-08-23T15:46:07.568Z", "assignerShortName": "Patchstack"}, "dataVersion": "5.2"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:yookassa:yukassa_for_woocommerce:*:*:*:*:*:wordpress:*:*", "matchCriteriaId": "F929DE85-1CD0-470B-A0A9-57B5D8714BC1", "versionEndExcluding": "2.3.1", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "Authenticated Arbitrary Settings Update vulnerability in YooMoney \u042eKassa \u0434\u043b\u044f WooCommerce plugin <= 2.3.0 at WordPress."}, {"lang": "es", "value": "Una vulnerabilidad de Actualizaci\u00f3n de Configuraci\u00f3n Arbitraria Autenticada en el plugin YooMoney ?Kassa ?? WooCommerce plugin versiones anteriores a 2.3.0 incluy\u00e9ndola, en WordPress."}], "id": "CVE-2022-34868", "lastModified": "2024-11-21T07:10:20.183", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 5.9, "source": "audit@patchstack.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2022-08-23T16:15:10.633", "references": [{"source": "audit@patchstack.com", "tags": ["Patch", "Third Party Advisory"], "url": "https://patchstack.com/database/vulnerability/yookassa/wordpress-yukassa-dlya-woocommerce-plugin-2-3-0-authenticated-arbitrary-settings-update-vulnerability"}, {"source": "audit@patchstack.com", "tags": ["Release Notes", "Third Party Advisory"], "url": "https://wordpress.org/plugins/yookassa/#developers"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch", "Third Party Advisory"], "url": "https://patchstack.com/database/vulnerability/yookassa/wordpress-yukassa-dlya-woocommerce-plugin-2-3-0-authenticated-arbitrary-settings-update-vulnerability"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Release Notes", "Third Party Advisory"], "url": "https://wordpress.org/plugins/yookassa/#developers"}], "sourceIdentifier": "audit@patchstack.com", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-264"}], "source": "audit@patchstack.com", "type": "Secondary"}, {"description": [{"lang": "en", "value": "NVD-CWE-Other"}], "source": "nvd@nist.gov", "type": "Primary"}]}