Lucene search

WPScanCVELIST:CVE-2022-0594

HistoryJul 25, 2022 - 12:45 p.m.

CVE-2022-0594 Shareaholic < 9.7.6 - Information Disclosure

2022-07-2512:45:37

CWE-863

WPScan

www.cve.org

cve-2022-0594

shareaholic plugin

information disclosure

ajax action

unauthenticated users

authorization check

active plugins

php version

curl version

wordpress version

EPSS

0.002

Percentile

56.3%

JSON

The Professional Social Sharing Buttons, Icons & Related Posts WordPress plugin before 9.7.6 does not have proper authorisation check in one of the AJAX action, available to unauthenticated (in v < 9.7.5) and author+ (in v9.7.5) users, allowing them to call it and retrieve various information such as the list of active plugins, various version like PHP, cURL, WP etc.

CNA Affected

[
  {
    "product": "Professional Social Sharing Buttons, Icons & Related Posts – Shareaholic",
    "vendor": "Unknown",
    "versions": [
      {
        "lessThan": "9.7.6",
        "status": "affected",
        "version": "9.7.6",
        "versionType": "custom"
      }
    ]
  }
]

References

wpscan.com/vulnerability/4de9451e-2c8d-4d99-a255-b027466d29b1

EPSS

0.002

Percentile

56.3%

JSON

Related for CVELIST:CVE-2022-0594