CoreCVE
Back

HIGH

miniOrange's Google Authenticator < 5.5 - Unauthenticated Arbitrary Options Deletion

Published Mar 21, 2022

Description

The miniOrange's Google Authenticator WordPress plugin before 5.5 does not have proper authorisation and CSRF checks when handling the reconfigureMethod, and does not validate the parameters passed to it properly. As a result, unauthenticated users could delete arbitrary options from the blog, making it unusable.

Affected products

Remediation

No remediation recorded yet.

Weaknesses (2)

CWE-352

CSRF

CWE-862

Missing Authorization

References (2)

Change history (0)

No recorded changes yet.

Sources

CVE.org / MITRE

Status PUBLISHED
Assigner WPScan
Published Mar 21, 2022
Updated Aug 2, 2024
Reserved Jan 14, 2022
Link CVE-2022-0229

CISA Vulnrichment

No data

NVD

Status Modified
Modified Jun 17, 2026
Link CVE-2022-0229

Red Hat

No data

ENISA EUVD

Assigner WPScan
Published Mar 21, 2022
Updated Aug 2, 2024
Link EUVD-2022-15426

GitHub

No data