CVE-2022-3097 LBStopAttack < 1.1.3 - Arbitrary Settings Update via CSRF

2022-10-2500:00:00

WPScan

www.cve.org

cve-2022-3097; lbstopattack; wordpress; csrf; plugin; settings update; security vulnerability; nonces; csrf attack.

0.001 Low

EPSS

Percentile

34.1%

JSON

The Plugin LBstopattack WordPress plugin before 1.1.3 does not use nonces when saving its settings, making it possible for attackers to conduct CSRF attacks. This could allow attackers to disable the plugin’s protections.

CNA Affected

[
  {
    "vendor": "Unknown",
    "product": "Plugin LBstopattack",
    "collectionURL": "https://wordpress.org/plugins",
    "versions": [
      {
        "status": "affected",
        "versionType": "custom",
        "version": "0",
        "lessThan": "1.1.3"
      }
    ],
    "defaultStatus": "unaffected"
  }
]

References

wpscan.com/vulnerability/9ebb8318-ebaf-4de7-b337-c91327685a43

0.001 Low

EPSS

Percentile

34.1%

JSON

Related for CVELIST:CVE-2022-3097