CVE-2022-0313

🗓️ 21 Feb 2022 10:46:15Reported by WPScanType

cve🔗 web.nvd.nist.gov👁 97 Views🌐 WEB

The Float menu WordPress plugin before 4.3.1 lacks CSRF protection when deleting menu, enabling attackers to force a logged in admin to delete via CSRF attack

Reporter	Title	Published	Views	Family All 10
CNNVD	WordPress 跨站请求伪造漏洞	21 Feb 202200:00	–	cnnvd
CNVD	Wordpress plugin Float menu cross-site request forgery vulnerability	23 Feb 202200:00	–	cnvd
Cvelist	CVE-2022-0313 Float Menu < 4.3.1 - Arbitrary Menu Deletion via CSRF	21 Feb 202210:46	–	cvelist
EUVD	EUVD-2022-15484	3 Oct 202520:07	–	euvd
NVD	CVE-2022-0313	21 Feb 202211:15	–	nvd
Patchstack	WordPress Float menu plugin <= 4.3 - Arbitrary Menu Deletion via Cross-Site Request Forgery (CSRF) vulnerability	24 Jan 202200:00	–	patchstack
Prion	Cross site request forgery (csrf)	21 Feb 202211:15	–	prion
RedhatCVE	CVE-2022-0313	9 Jan 202610:45	–	redhatcve
wpexploit	Float Menu < 4.3.1 - Arbitrary Menu Deletion via CSRF	24 Jan 202200:00	–	wpexploit
WPVulnDB	Float Menu < 4.3.1 - Arbitrary Menu Deletion via CSRF	24 Jan 202200:00	–	wpvulndb

NVD

Vulners

Node

wow-estore float_menuRange<4.3.1wordpress

[
  {
    "product": "Float menu – awesome floating side menu",
    "vendor": "Unknown",
    "versions": [
      {
        "lessThan": "4.3.1",
        "status": "affected",
        "version": "4.3.1",
        "versionType": "custom"
      }
    ]
  }
]

Source	Link
wpscan	www.wpscan.com/vulnerability/1ce6c8f4-6f4b-4d56-8d11-43355ef32e8c
plugins	www.plugins.trac.wordpress.org/changeset/2661431

Parameter	Position	Path	Description	CWE
did	query param	wp-admin/admin.php?page=float-menu&info=delete&did=1	CSRF vulnerability enabling a logged-in admin to delete a menu item via forged request	CWE-352

21 Nov 2024 06:38Current

4.4Medium risk

Vulners AI Score4.4

CVSS 3.14.3

CVSS 24.3

EPSS0.00103

CWE-352