CVE-2022-4004 - Donation Button <= 4.0.0 - Subscriber+ Broken Access Control leading to SMS Spam

Back Back to CVE browser

MEDIUM

Donation Button <= 4.0.0 - Subscriber+ Broken Access Control leading to SMS Spam

Published Dec 12, 2022

4.3

MEDIUM

CVSS 3.1

EPSS 0.49%

Description

The Donation Button WordPress plugin through 4.0.0 does not properly check for privileges and nonce tokens in its "donation_button_twilio_send_test_sms" AJAX action, which may allow any users with an account on the affected site, like subscribers, to use the plugin's Twilio integration to send SMSes to arbitrary phone numbers.

Affected products

Vendor n/a Product Donation Button Default
affected
Affected
- ≥ 0, ≤ 4.0.0

Default status is the baseline for the product. Each version can override it (patched versions can be marked unaffected).

Vendor	Product	Default status	Versions
n/a	Donation Button	affected	Affected ≥ 0, ≤ 4.0.0

Remediation

No remediation recorded yet.

Weaknesses (0)

No CWE recorded.

References (2)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-51385
Advisory
https://wpscan.com/vulnerability/6a3bcfb3-3ede-459d-969f-b7b30dafd098
exploitvdb-entrytechnical-descriptionThird Party Advisory

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-51385		Advisory
https://wpscan.com/vulnerability/6a3bcfb3-3ede-459d-969f-b7b30dafd098		exploitvdb-entrytechnical-descriptionThird Party Advisory

Change history (0)

No recorded changes yet.

Sources

CVE.org / MITRE

Status PUBLISHED

Assigner WPScan

Published Dec 12, 2022

Updated Apr 22, 2025

Reserved Nov 15, 2022

Link CVE-2022-4004

CISA Vulnrichment

Updated Apr 22, 2025

NVD

Status Modified

Modified Jun 17, 2026

Link CVE-2022-4004

Red Hat

No data

ENISA EUVD

Assigner WPScan

Published Dec 12, 2022

Updated Apr 22, 2025

Link EUVD-2022-51385

GitHub

No data