CVE-2022-2276 WP Edit Menu < 1.5.0 - Unauthenticated Arbitrary Post Deletion

2022-08-2215:00:57

CWE-862

CWE-352

WPScan

www.cve.org

cve-2022-2276

wp edit menu

unauthenticated

arbitrary

post deletion

ajax action

AI Score

5.1

Confidence

High

EPSS

0.001

Percentile

31.6%

JSON

The WP Edit Menu WordPress plugin before 1.5.0 does not have authorisation and CSRF in an AJAX action, which could allow unauthenticated attackers to delete arbitrary posts/pages from the blog

CNA Affected

[
  {
    "product": "WP Edit Menu",
    "vendor": "Unknown",
    "versions": [
      {
        "lessThan": "1.5.0",
        "status": "affected",
        "version": "1.5.0",
        "versionType": "custom"
      }
    ]
  }
]