CVE-2022-1610

🗓️ 20 Jun 2022 10:25:53Reported by WPScanType

cve🔗 web.nvd.nist.gov📰️ 5 Media mentions👁 73 Views🌐 WEB

The Seamless Donations WordPress plugin before 5.1.9 allows CSRF attack

Reporter	Title	Published	Views	Family All 12
ATTACKERKB	CVE-2022-1610	20 Jun 202211:15	–	attackerkb
CNNVD	WordPress plugin Seamless Donations 跨站请求伪造漏洞	20 Jun 202200:00	–	cnnvd
CNVD	WordPress Seamless Donations plugin跨站请求伪造漏洞	22 Jun 202200:00	–	cnvd
Cvelist	CVE-2022-1610 Seamless Donations < 5.1.9 - Arbitrary Settings Update via CSRF	20 Jun 202210:25	–	cvelist
EUVD	EUVD-2022-24899	3 Oct 202520:07	–	euvd
NVD	CVE-2022-1610	20 Jun 202211:15	–	nvd
OSV	CVE-2022-1610	20 Jun 202211:15	–	osv
Patchstack	WordPress Seamless Donations plugin <= 5.1.8 - Arbitrary Settings Update via Cross-Site Request Forgery (CSRF) vulnerability	26 May 202200:00	–	patchstack
Prion	Cross site request forgery (csrf)	20 Jun 202211:15	–	prion
RedhatCVE	CVE-2022-1610	22 May 202523:31	–	redhatcve

NVD

Vulners

Node

seamless_donations_project seamless_donationsRange<5.1.9wordpress

[
  {
    "product": "Seamless Donations: A Platform for Global Fundraising and Rebuilding using Stripe and PayPal",
    "vendor": "Unknown",
    "versions": [
      {
        "lessThan": "5.1.9",
        "status": "affected",
        "version": "5.1.9",
        "versionType": "custom"
      }
    ]
  }
]

Source	Link
wpscan	www.wpscan.com/vulnerability/88014da6-6179-4527-8f67-fbb610804d93

Parameter	Position	Path	Description	CWE
action	path	/wp-admin/admin-post.php	CSRF vulnerability: update settings via admin-post.php could be exploited to change plugin settings by an attacker posing as an authenticated admin	CWE-352
seamless_donations_template_email_test	path	/wp-admin/admin-post.php	CSRF vulnerability: update settings via admin-post.php could be exploited to change plugin settings by an attacker posing as an authenticated admin	CWE-352
dgx_donate_button_settings_templates_test_email	path	/wp-admin/admin-post.php	CSRF vulnerability: update settings via admin-post.php could be exploited to change plugin settings by an attacker posing as an authenticated admin	CWE-352
dgx_donate_email_name	path	/wp-admin/admin-post.php	CSRF vulnerability: update settings via admin-post.php could be exploited to change plugin settings by an attacker posing as an authenticated admin	CWE-352
dgx_donate_email_reply	path	/wp-admin/admin-post.php	CSRF vulnerability: update settings via admin-post.php could be exploited to change plugin settings by an attacker posing as an authenticated admin	CWE-352
dgx_donate_email_subj	path	/wp-admin/admin-post.php	CSRF vulnerability: update settings via admin-post.php could be exploited to change plugin settings by an attacker posing as an authenticated admin	CWE-352
dgx_donate_email_body	path	/wp-admin/admin-post.php	CSRF vulnerability: update settings via admin-post.php could be exploited to change plugin settings by an attacker posing as an authenticated admin	CWE-352
dgx_donate_email_recur	path	/wp-admin/admin-post.php	CSRF vulnerability: update settings via admin-post.php could be exploited to change plugin settings by an attacker posing as an authenticated admin	CWE-352
dgx_donate_email_desig	path	/wp-admin/admin-post.php	CSRF vulnerability: update settings via admin-post.php could be exploited to change plugin settings by an attacker posing as an authenticated admin	CWE-352
dgx_donate_email_anon	path	/wp-admin/admin-post.php	CSRF vulnerability: update settings via admin-post.php could be exploited to change plugin settings by an attacker posing as an authenticated admin	CWE-352

21 Nov 2024 06:41Current

6.3Medium risk

Vulners AI Score6.3

CVSS 24.3

CVSS 3.16.5

EPSS0.00103

CWE-352