CVE-2022-0837 - Amelia < 1.0.48 - Customer+ SMS Service Abuse and Sensitive Data Disclosure

Back Back to CVE browser

MEDIUM

Amelia < 1.0.48 - Customer+ SMS Service Abuse and Sensitive Data Disclosure

Published Apr 4, 2022

5.4

MEDIUM

CVSS 3.1

EPSS 0.62%

Description

The Amelia WordPress plugin before 1.0.48 does not have proper authorisation when handling Amelia SMS service, allowing any customer to send paid test SMS notification as well as retrieve sensitive information about the admin, such as the email, account balance and payment history. A malicious actor can abuse this vulnerability to drain out the account balance by keep sending SMS notification.

Affected products

Vendor n/a Product Amelia Default
unaffected
Affected
- ≥ 0, < 1.0.48

Default status is the baseline for the product. Each version can override it (patched versions can be marked unaffected).

Vendor	Product	Default status	Versions
n/a	Amelia	unaffected	Affected ≥ 0, < 1.0.48

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-862

Missing Authorization

References (2)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-15883
Advisory
https://wpscan.com/vulnerability/0882e5c0-f319-4994-9346-aa18438fda6a
exploitvdb-entrytechnical-descriptionThird Party Advisory

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-15883		Advisory
https://wpscan.com/vulnerability/0882e5c0-f319-4994-9346-aa18438fda6a		exploitvdb-entrytechnical-descriptionThird Party Advisory

Change history (0)

No recorded changes yet.

Sources

CVE.org / MITRE

Status PUBLISHED

Assigner WPScan

Published Apr 4, 2022

Updated Aug 2, 2024

Reserved Mar 3, 2022

Link CVE-2022-0837

CISA Vulnrichment

No data

NVD

Status Modified

Modified Jun 17, 2026

Link CVE-2022-0837

Red Hat

No data

ENISA EUVD

Assigner WPScan

Published Apr 4, 2022

Updated Aug 2, 2024

Link EUVD-2022-15883

GitHub

No data