CVE-2022-0593

🗓️ 14 Mar 2022 14:41:36Reported by WPScanType

cve🔗 web.nvd.nist.gov👁 79 Views🌐 WEB

The Login with phone number WordPress plugin before 1.3.7 allows unauthenticated deletion of files, leading to potential DoS

Reporter	Title	Published	Views	Family All 10
Circl	CVE-2022-0593	14 Mar 202217:18	–	circl
CNNVD	WordPress plugin 安全漏洞	14 Mar 202200:00	–	cnnvd
Cvelist	CVE-2022-0593 Login with phone number < 1.3.7 - Unauthenticated remote plugin deletion	14 Mar 202214:41	–	cvelist
EUVD	EUVD-2022-15700	3 Oct 202520:07	–	euvd
NVD	CVE-2022-0593	14 Mar 202215:15	–	nvd
Patchstack	WordPress Login with phone number plugin <= 1.3.6 - Unauthenticated Remote Plugin Deletion vulnerability	16 Feb 202200:00	–	patchstack
Prion	Authorization	14 Mar 202215:15	–	prion
RedhatCVE	CVE-2022-0593	22 May 202522:04	–	redhatcve
wpexploit	Login with phone number < 1.3.7 - Unauthenticated remote plugin deletion	16 Feb 202200:00	–	wpexploit
WPVulnDB	Login with phone number < 1.3.7 - Unauthenticated remote plugin deletion	16 Feb 202200:00	–	wpvulndb

NVD

Vulners

Node

idehweb login_with_phone_numberRange<1.3.7wordpress

[
  {
    "product": "Login with phone number",
    "vendor": "Unknown",
    "versions": [
      {
        "lessThan": "1.3.7",
        "status": "affected",
        "version": "1.3.7",
        "versionType": "custom"
      }
    ]
  }
]

Source	Link
wpscan	www.wpscan.com/vulnerability/76a50157-04b5-43e8-afbc-a6ddf6d1cba3
wordpress	www.wordpress.org/plugins/login-with-phone-number

Parameter	Position	Path	Description	CWE
delete	query param	wp-content/plugins/login-with-phone-number/delete.php	Unauthenticated access to delete.php allows remote deletion of plugin files, potentially causing DoS.	CWE-73

21 Nov 2024 06:38Current

6.6Medium risk

Vulners AI Score6.6

CVSS 26.4

CVSS 3.16.5

EPSS0.00539

CWE-73