CVE-2022-29441 - WordPress Private Messages For WordPress plugin <= 2.1.10 - Sending Messages via Cross-Site Request Forgery (CSRF) vulnerability

MEDIUM

WordPress Private Messages For WordPress plugin <= 2.1.10 - Sending Messages via Cross-Site Request Forgery (CSRF) vulnerability

Published Jun 15, 2022

4.3

MEDIUM

CVSS 3.1

EPSS 0.40%

Cross-Site Request Forgery (CSRF) vulnerability in Private Messages For WordPress plugin <= 2.1.10 at WordPress allows attackers to send messages.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

n/a

Version	Status	Constraints
<= 2.1.10	affected	<=2.1.10

No remediation recorded yet.

Weaknesses (1)

CWE-352

CSRF

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-33779		Advisory
https://patchstack.com/database/vulnerability/private-messages-for-wordpress/wordpress-private-messages-for-wordpress-plugin-2-1-10-sending-messages-via-cross-site-request-forgery-csrf-vulnerability		x_refsource_CONFIRMThird Party Advisory
https://wordpress.org/plugins/private-messages-for-wordpress/		x_refsource_CONFIRMProduct