Lucene search
HistoryJan 16, 2023 - 4:15 p.m.
CVE-2022-4309
subscribe2
wordpress
csrf
vulnerability
delete users
CVSS3
3.1
Attack Vector
NETWORK
Attack Complexity
HIGH
Privileges Required
NONE
User Interaction
REQUIRED
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
LOW
Availability Impact
NONE
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N
AI Score
3.9
Confidence
High
EPSS
0.001
Percentile
33.7%
The Subscribe2 WordPress plugin before 10.38 does not have CSRF check when deleting users, which could allow attackers to make a logged in admin delete arbitrary users by knowing their email via a CSRF attack.
Affected configurations
Node
subscribe2_projectsubscribe2Range<10.38wordpress
| Vendor | Product | Version | CPE |
|---|---|---|---|
| subscribe2_project | subscribe2 | * | cpe:2.3:a:subscribe2_project:subscribe2:*:*:*:*:*:wordpress:*:* |
Related
prion
prion
Cross site request forgery (csrf)
2023-01-16 16:15:00
cve
cve
CVE-2022-4309
2023-01-16 16:15:11
cvelist
cvelist
CVE-2022-4309 Subscribe2 < 10.38 - User Deletion via CSRF
2023-01-16 15:38:10
CVSS3
3.1
Attack Vector
NETWORK
Attack Complexity
HIGH
Privileges Required
NONE
User Interaction
REQUIRED
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
LOW
Availability Impact
NONE
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N
AI Score
3.9
Confidence
High
EPSS
0.001
Percentile
33.7%
Related for NVD:CVE-2022-4309