CVE-2022-2350 Disable User Login <= 1.0.1 - Unauthenticated Settings Update

2022-10-1000:00:00

CWE-862

CWE-352

WPScan

www.cve.org

wordpress plugin unauthenticated attackers

EPSS

0.001

Percentile

39.5%

JSON

The Disable User Login WordPress plugin through 1.0.1 does not have authorisation and CSRF checks when updating its settings, allowing unauthenticated attackers to block (or unblock) users at will.

CNA Affected

[
  {
    "vendor": "Unknown",
    "product": "Disable User Login",
    "versions": [
      {
        "version": "1.0.1",
        "status": "affected",
        "lessThanOrEqual": "1.0.1",
        "versionType": "custom"
      }
    ]
  }
]

References

wpscan.com/vulnerability/de28543b-c110-4a9f-bfe9-febccfba3a96

EPSS

0.001

Percentile

39.5%

JSON

Related for CVELIST:CVE-2022-2350