CVE-2022-1790

🗓️ 13 Jun 2022 12:42:57Reported by WPScanType

cve🔗 web.nvd.nist.gov📰️ 5 Media mentions👁 65 Views🌐 WEB

The New User Email Set Up WordPress plugin v0.5.2 is vulnerable to CSRF attack

Reporter	Title	Published	Views	Family All 12
ATTACKERKB	CVE-2022-1790	13 Jun 202213:15	–	attackerkb
CNNVD	WordPress plugin New User Email Set Up 跨站请求伪造漏洞	13 Jun 202200:00	–	cnnvd
CNVD	WordPress New User Email Set Up plugin Cross-Site Request Forgery Vulnerability	15 Jun 202200:00	–	cnvd
Cvelist	CVE-2022-1790 New User Email Set Up <= 0.5.2 - Arbitrary Settings Update via CSRF	13 Jun 202212:42	–	cvelist
EUVD	EUVD-2022-25070	3 Oct 202520:07	–	euvd
NVD	CVE-2022-1790	13 Jun 202213:15	–	nvd
OSV	CVE-2022-1790	13 Jun 202213:15	–	osv
Patchstack	WordPress New User Email Set Up plugin <= 0.5.2 - Arbitrary Settings Update via Cross-Site Request Forgery (CSRF) vulnerability	23 May 202200:00	–	patchstack
Prion	Cross site request forgery (csrf)	13 Jun 202213:15	–	prion
RedhatCVE	CVE-2022-1790	22 May 202523:32	–	redhatcve

NVD

Vulners

Node

new_user_email_set_up_project new_user_email_set_upRange≤0.5.2wordpress

[
  {
    "product": "New User Email Set Up",
    "vendor": "Unknown",
    "versions": [
      {
        "lessThanOrEqual": "0.5.2",
        "status": "affected",
        "version": "0.5.2",
        "versionType": "custom"
      }
    ]
  }
]

Source	Link
wpscan	www.wpscan.com/vulnerability/176d5761-4f01-4173-a70c-6052a6a9963e

Parameter	Position	Path	Description	CWE
option_page	request body	wp-admin/options-general.php?page=new-user-email-set-up%2Fnewuseremailsetup.php	CSRF vulnerability in plugin settings update allowing a logged-in admin to be forced to submit arbitrary settings.	CWE-352
action	request body	wp-admin/options-general.php?page=new-user-email-set-up%2Fnewuseremailsetup.php	CSRF vulnerability in plugin settings update allowing a logged-in admin to be forced to submit arbitrary settings.	CWE-352
newuseremailhtml	request body	wp-admin/options-general.php?page=new-user-email-set-up%2Fnewuseremailsetup.php	CSRF vulnerability in plugin settings update allowing a logged-in admin to be forced to submit arbitrary settings.	CWE-352
newuseremailsubject	request body	wp-admin/options-general.php?page=new-user-email-set-up%2Fnewuseremailsetup.php	CSRF vulnerability in plugin settings update allowing a logged-in admin to be forced to submit arbitrary settings.	CWE-352
newuseremailtext	request body	wp-admin/options-general.php?page=new-user-email-set-up%2Fnewuseremailsetup.php	CSRF vulnerability in plugin settings update allowing a logged-in admin to be forced to submit arbitrary settings.	CWE-352
newuseremailfromaddress	request body	wp-admin/options-general.php?page=new-user-email-set-up%2Fnewuseremailsetup.php	CSRF vulnerability in plugin settings update allowing a logged-in admin to be forced to submit arbitrary settings.	CWE-352
newuseremailfrom	request body	wp-admin/options-general.php?page=new-user-email-set-up%2Fnewuseremailsetup.php	CSRF vulnerability in plugin settings update allowing a logged-in admin to be forced to submit arbitrary settings.	CWE-352
nue_submit	request body	wp-admin/options-general.php?page=new-user-email-set-up%2Fnewuseremailsetup.php	CSRF vulnerability in plugin settings update allowing a logged-in admin to be forced to submit arbitrary settings.	CWE-352
newuseremailadmin	request body	wp-admin/options-general.php?page=new-user-email-set-up%2Fnewuseremailsetup.php	CSRF vulnerability in plugin settings update allowing a logged-in admin to be forced to submit arbitrary settings.	CWE-352
newuseremailadminnotifydiff	request body	wp-admin/options-general.php?page=new-user-email-set-up%2Fnewuseremailsetup.php	CSRF vulnerability in plugin settings update allowing a logged-in admin to be forced to submit arbitrary settings.	CWE-352

17 Jun 2026 04:23Current

6.3Medium risk

Vulners AI Score6.3

CVSS 24.3

CVSS 3.16.5

EPSS0.00513

CWE-352