CVE-2022-2350 in Disable User Login Plugin

Résumé

par MITRE • 11/10/2022

The Disable User Login WordPress plugin through 1.0.1 does not have authorisation and CSRF checks when updating its settings, allowing unauthenticated attackers to block (or unblock) users at will.

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

• Réserver: 08/07/2022
• Divulgation: 11/10/2022
• Modérer: accepté
• Entrée: VDB-210391
• CPE: prêt
• CWE: CWE-862 (confirmé)
• CVSS: 5.3 (NVD)
• EPSS: 0.00408
• KEV: non
• Activités: très faible
• Secteur: Hostingprovider

Sources

• MITRE: https://www.cve.org/CVERecord?id=CVE-2022-2350
• NVD: https://nvd.nist.gov/vuln/detail/CVE-2022-2350
• CVE Details: https://www.cvedetails.com/cve/CVE-2022-2350/