Lucene search
WPScanCVELIST:CVE-2022-3881HistoryDec 12, 2022 - 5:54 p.m.
CVE-2022-3881 WPTools < 3.43 - Subscriber+ Arbitrary Plugin Installation
2022-12-1217:54:54
WPScan
www.cve.org
2
cve-2022-3881
wptools
subscriber
arbitrary
plugin
installation
authorisation
csrf
ajax
wordpress.
The WP Tools Increase Maximum Limits, Repair, Server PHP Info, Javascript errors, File Permissions, Transients, Error Log WordPress plugin before 3.43 does not have proper authorisation and CSRF in an AJAX action, allowing any authenticated users, such as subscriber to call it and install and activate arbitrary plugins from wordpress.org
CNA Affected
[
{
"vendor": "Unknown",
"product": "WP Tools Increase Maximum Limits, Repair, Server PHP Info, Javascript errors, File Permissions, Transients, Error Log",
"collectionURL": "https://wordpress.org/plugins",
"versions": [
{
"status": "affected",
"versionType": "custom",
"version": "0",
"lessThan": "3.43"
}
],
"defaultStatus": "unaffected"
}
]Related
prion
prion
Cross site request forgery (csrf)
2022-12-12 18:15:00
nvd
nvd
CVE-2022-3881
2022-12-12 18:15:11
patchstack
patchstack
cve
cve
CVE-2022-3881
2022-12-12 18:15:11