CVE-2022-4309 - Subscribe2 < 10.38 - User Deletion via CSRF

Back Back to CVE browser

LOW

Subscribe2 < 10.38 - User Deletion via CSRF

Published Jan 16, 2023

3.1

LOW

CVSS 3.1

EPSS 0.24%

Description

The Subscribe2 WordPress plugin before 10.38 does not have CSRF check when deleting users, which could allow attackers to make a logged in admin delete arbitrary users by knowing their email via a CSRF attack.

Affected products

Vendor n/a Product Subscribe2 Default
unaffected
- Version
  0
  Status
  affected
  Constraints
  <10.38

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

n/a

Subscribe2

unaffected

Version	Status	Constraints
0	affected	<10.38

Remediation

No remediation recorded yet.

Weaknesses (0)

No CWE recorded.

References (1)

https://wpscan.com/vulnerability/1965f53d-c94e-4322-9059-49de69df1051
exploitvdb-entrytechnical-descriptionThird Party Advisory

Link	Providers	Tags
https://wpscan.com/vulnerability/1965f53d-c94e-4322-9059-49de69df1051		exploitvdb-entrytechnical-descriptionThird Party Advisory

Change history (0)

No recorded changes yet.

Sources

CVE.org / MITRE

Status PUBLISHED

Assigner WPScan

Published Jan 16, 2023

Updated Apr 7, 2025

Reserved Dec 6, 2022

Link CVE-2022-4309

CISA Vulnrichment

Updated Apr 7, 2025

NVD

Status Modified

Modified Jun 17, 2026

Link CVE-2022-4309

Red Hat

Severity n/a

Public date n/a

Links CVE-2022-4309