CVE-2022-3883 - StopBadBots < 7.24 - Subscriber+ Arbitrary Plugin Installation · CoreCVE

Back Back to CVE browser

MEDIUM

StopBadBots < 7.24 - Subscriber+ Arbitrary Plugin Installation

Published Dec 12, 2022

6.5

MEDIUM

CVSS 3.1

EPSS 0.33%

Description

The Block Bad Bots and Stop Bad Bots Crawlers and Spiders and Anti Spam Protection WordPress plugin before 7.24 does not have proper authorisation and CSRF in an AJAX action, allowing any authenticated users, such as subscriber to call it and install and activate arbitrary plugins from wordpress.org

Affected products

Vendor n/a Product Block Bad Bots and Stop Bad Bots Crawlers and Spiders and Anti Spam Protection Default
unaffected
- Version
  0
  Status
  affected
  Constraints
  <7.24

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

n/a

Block Bad Bots and Stop Bad Bots Crawlers and Spiders and Anti Spam Protection

unaffected

Version	Status	Constraints
0	affected	<7.24

Remediation

No remediation recorded yet.

Weaknesses (2)

CWE-352

CSRF

CWE-863

Incorrect Authorization

References (1)

https://wpscan.com/vulnerability/8695b157-abac-4aa6-a022-e3ae41c03544
exploitvdb-entrytechnical-descriptionThird Party Advisory

Link	Providers	Tags
https://wpscan.com/vulnerability/8695b157-abac-4aa6-a022-e3ae41c03544		exploitvdb-entrytechnical-descriptionThird Party Advisory

Change history (0)

No recorded changes yet.

Sources

CVE.org / MITRE

Status PUBLISHED

Assigner WPScan

Published Dec 12, 2022

Updated Apr 22, 2025

Reserved Nov 7, 2022

Link CVE-2022-3883

CISA Vulnrichment

Updated Apr 22, 2025

Status Modified

Modified Jun 17, 2026

Link CVE-2022-3883

Severity n/a

Public date n/a

Links CVE-2022-3883