Lucene search
HistoryNov 07, 2022 - 10:15 a.m.
CVE-2022-3489
wp hide wordpress
authorisation
csrf checks
unauthenticated attackers
custom_wpadmin_slug
5.3 Medium
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
LOW
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
0.001 Low
EPSS
Percentile
39.6%
The WP Hide WordPress plugin through 0.0.2 does not have authorisation and CSRF checks in place when updating the custom_wpadmin_slug settings, allowing unauthenticated attackers to update it with a crafted request
Affected configurations
Node
webergewp_hideRange≤0.0.2wordpress
Related
wpexploit
wpexploit
WP Hide <= 0.0.2 - Unauthenticated Settings Update
2022-10-17 00:00:00
cve
cve
CVE-2022-3489
2022-11-07 10:15:11
wpvulndb
wpvulndb
WP Hide <= 0.0.2 - Unauthenticated Settings Update
2022-10-17 00:00:00
cvelist
cvelist
CVE-2022-3489 WP Hide <= 0.0.2 - Unauthenticated Settings Update
2022-11-07 00:00:00
prion
prion
Cross site request forgery (csrf)
2022-11-07 10:15:00
5.3 Medium
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
LOW
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
0.001 Low
EPSS
Percentile
39.6%
Related for NVD:CVE-2022-3489