CVE-2022-1625 New User Approve < 2.4 - Arbitrary Settings Update & Invitation Code Creation via CSRF

2022-06-2708:57:11

CWE-352

WPScan

www.cve.org

new user approve

csrf

settings update

invitation code creation

wordpress

plugin

admin users

bypassing restrictions

AI Score

4.9

Confidence

High

EPSS

0.001

Percentile

25.9%

JSON

The New User Approve WordPress plugin before 2.4 does not have CSRF check in place when updating its settings and adding invitation codes, which could allow attackers to add invitation codes (for bypassing the provided restrictions) and to change plugin settings by tricking admin users into visiting specially crafted websites.

CNA Affected

[
  {
    "product": "New User Approve",
    "vendor": "Unknown",
    "versions": [
      {
        "lessThan": "2.4",
        "status": "affected",
        "version": "2.4",
        "versionType": "custom"
      }
    ]
  }
]