CVE-2022-1576

🗓️ 11 Jul 2022 12:55:56Reported by WPScanType

cve🔗 web.nvd.nist.gov📰️ 3 Media mentions👁 78 Views🌐 WEB

The WP Maintenance Mode & Coming Soon WordPress plugin before 2.4.5 is lacking CSRF protectio

Reporter	Title	Published	Views	Family All 13
ATTACKERKB	CVE-2022-1576	11 Jul 202213:15	–	attackerkb
Circl	CVE-2022-1576	11 Jul 202216:19	–	circl
CNNVD	WordPress plugin Maintenance Mode & Coming Soon 跨站请求伪造漏洞	11 Jul 202200:00	–	cnnvd
CNVD	WordPress Maintenance Mode	13 Jul 202200:00	–	cnvd
Cvelist	CVE-2022-1576 WP Maintenance Mode & Coming Soon < 2.4.5 - Subscribed Users Deletion via CSRF	11 Jul 202212:55	–	cvelist
EUVD	EUVD-2022-24867	3 Oct 202520:07	–	euvd
NVD	CVE-2022-1576	11 Jul 202213:15	–	nvd
OpenVAS	WordPress Maintenance Mode Plugin < 2.4.5 CSRF Vulnerability	12 Jul 202200:00	–	openvas
Patchstack	WordPress WP Maintenance Mode & Coming Soon plugin <= 2.4.4 - Subscribed Users Deletion via Cross-Site Request Forgery (CSRF) vulnerability	20 Jun 202200:00	–	patchstack
Prion	Cross site request forgery (csrf)	11 Jul 202213:15	–	prion

NVD

Vulners

Node

themeisle wp_maintenance_mode_&_coming_soonRange<2.4.5wordpress

[
  {
    "product": "WP Maintenance Mode & Coming Soon",
    "vendor": "Unknown",
    "versions": [
      {
        "lessThan": "2.0.4*",
        "status": "affected",
        "version": "2.0.4",
        "versionType": "custom"
      },
      {
        "lessThan": "2.4.5",
        "status": "affected",
        "version": "2.4.5",
        "versionType": "custom"
      }
    ]
  }
]

Source	Link
wpscan	www.wpscan.com/vulnerability/68deab46-1c16-46ae-a912-a104958ca4cf

Parameter	Position	Path	Description	CWE
action	request body	wp-admin/admin-ajax.php	CSRF vulnerability enabling a logged-in admin action to empty the subscribed users list (improper CSRF protection).	CWE-352

21 Nov 2024 06:41Current

6.3Medium risk

Vulners AI Score6.3

CVSS 24.3

CVSS 3.16.5

EPSS0.0014

CWE-352