7.5

CVE-2022-1589

Exploit

Change wp-admin Login < 1.1.0 - Unauthenticated Arbitrary Settings Update

Change WP Admin Login <= 1.0.9 - Missing Authorization Checks

The Change wp-admin login WordPress plugin before 1.1.0 does not properly check for authorisation and is also missing CSRF check when updating its settings, which could allow unauthenticated users to change the settings. The attacked could also be performed via a CSRF vector
Mögliche Gegenmaßnahme
All In One Login — Login Page Security and Customization for WordPress with Google reCAPTCHA, Social Login, Temporary Login, 2FA, and more.: Update to version 1.1.0, or a newer patched version
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Wpexperts ≫ All In One Login SwEdition- SwPlatformwordpress Version < 1.1.0
Weitere Schwachstelleninformationen
SystemWordPress Plugin
≫
Produkt All In One Login — Login Page Security and Customization for WordPress with Google reCAPTCHA, Social Login, Temporary Login, 2FA, and more.
Version *-1.0.9
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.58% 0.43
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 7.5 3.9 3.6
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
nvd@nist.gov 5 10 2.9
AV:N/AC:L/Au:N/C:N/I:P/A:N
CWE-352 Cross-Site Request Forgery (CSRF)

The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request.

CWE-863 Incorrect Authorization

The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

https://wpscan.com/vulnerability/257f9e14-4f43-4852-8384-80c15d087633
Third Party Advisory
Exploit
https://www.wordfence.com/threat-intel/vulnerabilities/id/616c8ab8-3200-41fb-9d31-5d36873742cb
Third Party Advisory