CVE-2022-4024

Published Dec 19, 2022

Last updated a year ago

CVSS medium 6.5

Overview

Description: The Registration Forms WordPress plugin before 3.8.1.3 does not have authorisation and CSRF when deleting users via an init action handler, allowing unauthenticated attackers to delete arbitrary users (along with their posts)
Source: contact@wpscan.com
NVD status: Modified

Risk scores

CVSS 3.1

Type: Primary
Base score: 6.5
Impact score: 3.6
Exploitability score: 2.8
Vector string: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
Severity: MEDIUM

Weaknesses

nvd@nist.gov: CWE-352

Hype score: Not currently trending

Configurations

[
  {
    "nodes": [
      {
        "negate": false,
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:a:genetechsolutions:pie_register:*:*:*:*:*:wordpress:*:*",
            "vulnerable": true,
            "matchCriteriaId": "1E288D5D-C2AA-4309-9604-21B3612CB3DF",
            "versionEndExcluding": "3.8.1.3"
          }
        ],
        "operator": "OR"
      }
    ]
  }
]

References