CVE-2022-1599 Admin Management Xtended < 2.4.5 - Post Visibility/Date/Comment Status Update via CSRF

2022-07-1112:56:01

CWE-352

WPScan

www.cve.org

wordpress

csrf

vulnerability

admin management xtended

ajax actions

EPSS

0.001

Percentile

26.3%

JSON

The Admin Management Xtended WordPress plugin before 2.4.5 does not have CSRF checks in some of its AJAX actions, allowing attackers to make a logged users with the right capabilities to call them. This can lead to changes in post status (draft, published), slug, post date, comment status (enabled, disabled) and more.

CNA Affected

[
  {
    "product": "Admin Management Xtended",
    "vendor": "Unknown",
    "versions": [
      {
        "lessThan": "2.4.5",
        "status": "affected",
        "version": "2.4.5",
        "versionType": "custom"
      }
    ]
  }
]

References

wpscan.com/vulnerability/4a36e876-7e3b-4a81-9f16-9ff5fbb20dd6

EPSS

0.001

Percentile

26.3%

JSON

Related for CVELIST:CVE-2022-1599