CVE-2022-0992

🗓️ 19 Apr 2022 20:26:33Reported by WordfenceType

cve🔗 web.nvd.nist.gov👁 106 Views🌐 WEB

The SiteGround Security plugin for WordPress is vulnerable to authentication bypass allowing unauthorized access to administrative accounts

Reporter	Title	Published	Views	Family All 15
0day.today	WordPress SiteGround Security 1.2.5 Authentication Bypass Vulnerability	8 Apr 202200:00	–	zdt
CNNVD	WordPress plugin SiteGround Security 访问控制错误漏洞	8 Apr 202200:00	–	cnnvd
Cvelist	CVE-2022-0992 SiteGround Security <= 1.2.5 - Authentication Bypass via 2FA Setup	19 Apr 202220:26	–	cvelist
EUVD	EUVD-2022-15985	3 Oct 202520:07	–	euvd
NVD	CVE-2022-0992	19 Apr 202221:15	–	nvd
OSV	CVE-2022-0992	19 Apr 202221:15	–	osv
Packet Storm	WordPress SiteGround Security 1.2.5 Authentication Bypass	8 Apr 202200:00	–	packetstorm
Patchstack	WordPress SiteGround Security plugin <= 1.2.5 - Authentication Bypass via 2-Factor Authentication Setup vulnerability	7 Apr 202200:00	–	patchstack
Prion	Authentication flaw	19 Apr 202221:15	–	prion
Positive Technologies	PT-2022-13577 · Siteground · Siteground Security Plugin	19 Apr 202200:00	–	ptsecurity

NVD

Vulners

Node

siteground security_optimizerRange<1.2.6wordpress

[
  {
    "vendor": "siteground",
    "product": "Security Optimizer – The All-In-One Protection Plugin",
    "versions": [
      {
        "version": "0",
        "status": "affected",
        "lessThanOrEqual": "1.2.5",
        "versionType": "semver"
      }
    ],
    "defaultStatus": "unaffected"
  }
]

Source	Link
wordfence	www.wordfence.com/threat-intel/vulnerabilities/id/6e5c6bf7-a653-4571-9566-574d2bb35c4f
plugins	www.plugins.trac.wordpress.org/changeset/2706302
wordfence	www.wordfence.com/blog/2022/04/critical-authentication-bypass-vulnerability-patched-in-siteground-security-plugin/

Parameter	Position	Path	Description	CWE
sg-user-id	path	/e3t/Ctc/GC+113/cwG7R04/VVv8XH4Dtx6JW4ZScBw4MDnfnW7TctdS4HBVbXN3rtP5V5js6pV3Zsc37CgZbDW5wrR-w7zY7KhW4Mrm4c5Zy32dW8XHhsP3P3WvbW1y7vnb2Lz_yCW3h74mS5vGQlSW1TtcL79kYcBBW6cPLyq42thMcW6CwF5w64p8MWW8SMZYL7Ry-RVW72ZMh97N4zYLW6GgBkG2wR-9mW7-b3XP3BhX0qVFdjjZ7wRBZ1W41BHlZ7HXk4_W8gYcdC6jDCSYW7WrVW87zzlt6N3b84wQv3fMrWvbW80zd5s8mFpr_W51NSZ988d_tMN3fRrg4mwDrfW6wrQ9H20MzKyW5chZKt59ZMQgW3mYpHp6XGDWWW81vjKm3DmQR9W86m5dc4X9LfMW3xYLTr441yX1W7x5YyR2gML9GW2ByWtF3NzNmzVGmQWX7Syqr9W7pfbrH7-fqv_W8sJj6l6JnsplW65b1k86jYkVB36K61	Authentication bypass during 2FA initial setup via user ID parameter	CWE-306, CWE-288
sg-user-id	query param	/e3t/Ctc/GC+113/cwG7R04/VVv8XH4Dtx6JW4ZScBw4MDnfnW7TctdS4HBVbXN3rtP5V5js6pV3Zsc37CgZbDW5wrR-w7zY7KhW4Mrm4c5Zy32dW8XHhsP3P3WvbW1y7vnb2Lz_yCW3h74mS5vGQlSW1TtcL79kYcBBW6cPLyq42thMcW6CwF5w64p8MWW8SMZYL7Ry-RVW72ZMh97N4zYLW6GgBkG2wR-9mW7-b3XP3BhX0qVFdjjZ7wRBZ1W41BHlZ7HXk4_W8gYcdC6jDCSYW7WrVW87zzlt6N3b84wQv3fMrWvbW80zd5s8mFpr_W51NSZ988d_tMN3fRrg4mwDrfW6wrQ9H20MzKyW5chZKt59ZMQgW3mYpHp6XGDWWW81vjKm3DmQR9W86m5dc4X9LfMW3xYLTr441yX1W7x5YyR2gML9GW2ByWtF3NzNmzVGmQWX7Syqr9W7pfbrH7-fqv_W8sJj6l6JnsplW65b1k86jYkVB36K61	Authorization weakness via 2FA backup codes allowing login without prior authenticated session	CWE-306, CWE-288
sgc2fabackupcode	query param	/e3t/Ctc/GC+113/cwG7R04/VVv8XH4Dtx6JW4ZScBw4MDnfnW7TctdS4HBVbXN3rtP5V5js6pV3Zsc37CgZbDW5wrR-w7zY7KhW4Mrm4c5Zy32dW8XHhsP3P3WvbW1y7vnb2Lz_yCW3h74mS5vGQlSW1TtcL79kYcBBW6cPLyq42thMcW6CwF5w64p8MWW8SMZYL7Ry-RVW72ZMh97N4zYLW6GgBkG2wR-9mW7-b3XP3BhX0qVFdjjZ7wRBZ1W41BHlZ7HXk4_W8gYcdC6jDCSYW7WrVW87zzlt6N3b84wQv3fMrWvbW80zd5s8mFpr_W51NSZ988d_tMN3fRrg4mwDrfW6wrQ9H20MzKyW5chZKt59ZMQgW3mYpHp6XGDWWW81vjKm3DmQR9W86m5dc4X9LfMW3xYLTr441yX1W7x5YyR2gML9GW2ByWtF3NzNmzVGmQWX7Syqr9W7pfbrH7-fqv_W8sJj6l6JnsplW65b1k86jYkVB36K61	Authorization weakness via 2FA backup codes allowing login without prior authenticated session	CWE-306, CWE-288

17 Jun 2026 04:21Current

9.4High risk

Vulners AI Score9.4

CVSS 27.5

CVSS 3.19.8

EPSS0.02878

SSVC