CVE-2022-3883

Published Dec 12, 2022

Last updated a year ago

CVSS medium 6.5

Overview

Description: The Block Bad Bots and Stop Bad Bots Crawlers and Spiders and Anti Spam Protection WordPress plugin before 7.24 does not have proper authorisation and CSRF in an AJAX action, allowing any authenticated users, such as subscriber to call it and install and activate arbitrary plugins from wordpress.org
Source: contact@wpscan.com
NVD status: Modified

Risk scores

CVSS 3.1

Type: Primary
Base score: 6.5
Impact score: 3.6
Exploitability score: 2.8
Vector string: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Severity: MEDIUM

Weaknesses

nvd@nist.gov: CWE-352

Hype score: Not currently trending

Configurations

[
  {
    "nodes": [
      {
        "negate": false,
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:a:stopbadbots_project:stopbadbots:*:*:*:*:*:wordpress:*:*",
            "vulnerable": true,
            "matchCriteriaId": "4DC9F486-4C19-44FB-934E-67C7C0B7BAFC",
            "versionEndExcluding": "7.24"
          }
        ],
        "operator": "OR"
      }
    ]
  }
]

References