CVE-2022-29414 - WordPress Subscribe To Comments Reloaded plugin <= 211130 - Multiple Cross-Site Request Forgery (CSRF) vulnerabilities

Back Back to CVE browser

MEDIUM

WordPress Subscribe To Comments Reloaded plugin <= 211130 - Multiple Cross-Site Request Forgery (CSRF) vulnerabilities

Published Apr 29, 2022

5.4

MEDIUM

CVSS 3.1

EPSS 0.39%

Description

Multiple (13x) Cross-Site Request Forgery (CSRF) vulnerabilities in WPKube's Subscribe To Comments Reloaded plugin <= 211130 on WordPress allows attackers to clean up Log archive, download system info file, plugin system settings, plugin options settings, generate a new key, reset all options, change notifications settings, management page settings, comment form settings, manage subscriptions > mass update settings, manage subscriptions > add a new subscription, update subscription, delete Subscription.

Affected products

Vendor WPKube Product Subscribe To Comments Reloaded (WordPress plugin) Default
n/a
- Version
  <= 211130
  Status
  affected
  Constraints
  <=211130

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

WPKube

Subscribe To Comments Reloaded (WordPress plugin)

n/a

Version	Status	Constraints
<= 211130	affected	<=211130

Remediation

Vendor solution

Update to 220502 or higher version.

Weaknesses (1)

CWE-352

CSRF

References (3)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-33752
Advisory
https://patchstack.com/database/vulnerability/subscribe-to-comments-reloaded/wordpress-subscribe-to-comments-reloaded-plugin-211130-multiple-cross-site-request-forgery-csrf-vulnerabilities
x_refsource_CONFIRMThird Party Advisory
https://wordpress.org/plugins/subscribe-to-comments-reloaded/
x_refsource_CONFIRMProductThird Party Advisory

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-33752		Advisory
https://patchstack.com/database/vulnerability/subscribe-to-comments-reloaded/wordpress-subscribe-to-comments-reloaded-plugin-211130-multiple-cross-site-request-forgery-csrf-vulnerabilities		x_refsource_CONFIRMThird Party Advisory
https://wordpress.org/plugins/subscribe-to-comments-reloaded/		x_refsource_CONFIRMProductThird Party Advisory