CVE-2022-4024

2022-12-1914:15:11

CWE-352

CWE-862

[email protected]

web.nvd.nist.gov

cve-2022-4024

registration forms

wordpress

plugin

authorization

csrf

user deletion

security vulnerability

nvd

6.5 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

0.001 Low

EPSS

Percentile

47.7%

JSON

The Registration Forms WordPress plugin before 3.8.1.3 does not have authorisation and CSRF when deleting users via an init action handler, allowing unauthenticated attackers to delete arbitrary users (along with their posts)

Affected configurations

Vulners

NVD

Node

easyregistrationformseasy_registration_formsRange<3.8.1.3

VendorProductVersionCPE
easyregistrationformseasy_registration_forms*cpe:2.3:a:easyregistrationforms:easy_registration_forms:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
easyregistrationforms	easy_registration_forms	*	cpe:2.3:a:easyregistrationforms:easy_registration_forms::::::::

CNA Affected

[
  {
    "vendor": "Unknown",
    "product": "Registration Forms",
    "collectionURL": "https://wordpress.org/plugins",
    "versions": [
      {
        "status": "affected",
        "versionType": "custom",
        "version": "0",
        "lessThan": "3.8.1.3"
      }
    ],
    "defaultStatus": "unaffected"
  }
]