CVE-2022-3489 - WP Hide <= 0.0.2 - Unauthenticated Settings Update

Back Back to CVE browser

MEDIUM

WP Hide <= 0.0.2 - Unauthenticated Settings Update

Published Nov 7, 2022

5.3

MEDIUM

CVSS 3.1

EPSS 0.37%

Description

The WP Hide WordPress plugin through 0.0.2 does not have authorisation and CSRF checks in place when updating the custom_wpadmin_slug settings, allowing unauthenticated attackers to update it with a crafted request

Affected products

Vendor n/a Product Wp-Hide Default
n/a
- Version
  0.0.2
  Status
  affected
  Constraints
  <=0.0.2

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

n/a

Wp-Hide

n/a

Version	Status	Constraints
0.0.2	affected	<=0.0.2

Remediation

No remediation recorded yet.

Weaknesses (2)

CWE-352

CSRF

CWE-862

Missing Authorization

References (2)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-42861
Advisory
https://wpscan.com/vulnerability/36d78b6c-0da5-44f8-b7b3-eae78edac505
ExploitThird Party Advisory

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-42861		Advisory
https://wpscan.com/vulnerability/36d78b6c-0da5-44f8-b7b3-eae78edac505		ExploitThird Party Advisory