Lucene search

WPScanCVE-2022-3881

HistoryDec 12, 2022 - 6:15 p.m.

CVE-2022-3881

2022-12-1218:15:11

CWE-352

CWE-863

WPScan

web.nvd.nist.gov

wp tools

increase maximum limits

repair

server php info

javascript errors

file permissions

transients

error log

wordpress

plugin

csrf

ajax

nvd

cve-2022-3881

CVSS3

5.7

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:N

AI Score

5.6

Confidence

High

EPSS

0.001

Percentile

21.4%

JSON

The WP Tools Increase Maximum Limits, Repair, Server PHP Info, Javascript errors, File Permissions, Transients, Error Log WordPress plugin before 3.43 does not have proper authorisation and CSRF in an AJAX action, allowing any authenticated users, such as subscriber to call it and install and activate arbitrary plugins from wordpress.org

Affected configurations

Nvd

Vulners

Node

wptools_projectwptoolsRange<3.43wordpress

VendorProductVersionCPE
wptools_projectwptools*cpe:2.3:a:wptools_project:wptools:*:*:*:*:*:wordpress:*:*

Vendor	Product	Version	CPE
wptools_project	wptools	*	cpe:2.3:a:wptools_project:wptools::::::wordpress::*

CNA Affected

[
  {
    "vendor": "Unknown",
    "product": "WP Tools Increase Maximum Limits, Repair, Server PHP Info, Javascript errors, File Permissions, Transients, Error Log",
    "collectionURL": "https://wordpress.org/plugins",
    "versions": [
      {
        "status": "affected",
        "versionType": "custom",
        "version": "0",
        "lessThan": "3.43"
      }
    ],
    "defaultStatus": "unaffected"
  }
]

References

wpscan.com/vulnerability/c2a9cf01-051a-429a-82ca-280885114b5a

CVSS3

5.7

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:N

AI Score

5.6

Confidence

High

EPSS

0.001

Percentile

21.4%

JSON

Related for CVE-2022-3881