Lucene search
K
Database
Vendors
Products
Years
CVSS
Scanner
Agent Scanning
API Scanning
Manual Audit
Perimeter Scanner
Scanning
Projects
Email
Webhook
Plugins
Resources
Documents
Blog
Glossary
FAQ
Pricing
Contacts
About Us
Partners
Branding Guideline
nvd[email protected]NVD:CVE-2022-3881
HistoryDec 12, 2022 - 6:15 p.m.

CVE-2022-3881

2022-12-1218:15:11
CWE-863
CWE-352
[email protected]
web.nvd.nist.gov
2
wordpress plugin
csrf
authorisation
arbitrary plugins

CVSS3

5.7

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:N

EPSS

0.001

Percentile

21.4%

JSON

The WP Tools Increase Maximum Limits, Repair, Server PHP Info, Javascript errors, File Permissions, Transients, Error Log WordPress plugin before 3.43 does not have proper authorisation and CSRF in an AJAX action, allowing any authenticated users, such as subscriber to call it and install and activate arbitrary plugins from wordpress.org

Affected configurations

Nvd
Node
wptools_projectwptoolsRange<3.43wordpress
VendorProductVersionCPE
wptools_projectwptools*cpe:2.3:a:wptools_project:wptools:*:*:*:*:*:wordpress:*:*

Related

prion 1
cve 1
patchstack 1
cvelist 1
prion
prion
Cross site request forgery (csrf)
2022-12-12 18:15:00
cve
cve
CVE-2022-3881
2022-12-12 18:15:11
patchstack
patchstack
WordPress WPTools plugin <= 3.42 - Auth. Arbitrary Plugin Installation vulnerability
2022-11-21 00:00:00
cvelist
cvelist
CVE-2022-3881 WPTools < 3.43 - Subscriber+ Arbitrary Plugin Installation
2022-12-12 17:54:54

CVSS3

5.7

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:N

EPSS

0.001

Percentile

21.4%

JSON
Related for NVD:CVE-2022-3881
prion1cve1patchstack1cvelist1