CVE-2022-4555 - WP Shamsi <= 4.1.0 - Missing Authorization to Arbitrary Plugin Deactivation

Back Back to CVE browser

MEDIUM

WP Shamsi <= 4.1.0 - Missing Authorization to Arbitrary Plugin Deactivation

Published Dec 16, 2022

6.5

MEDIUM

CVSS 3.1

EPSS 0.69%

Description

The WP Shamsi plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on the deactivate() function hooked via init() in versions up to, and including, 4.1.0. This makes it possible for unauthenticated attackers to deactivate arbitrary plugins on the site. This can be used to deactivate security plugins that aids in exploiting other vulnerabilities.

Affected products

Vendor Wpvar Product WP Shamsi – افزونه تاریخ شمسی و فارسی ساز وردپرس Default
unaffected
- Version
  -
  Status
  affected
  Constraints
  <=4.1.0

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Wpvar

WP Shamsi – افزونه تاریخ شمسی و فارسی ساز وردپرس

unaffected

Version	Status	Constraints
-	affected	<=4.1.0

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-862

Missing Authorization

References (4)

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-51890		Advisory
https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2645044%40wp-shamsi&new=2645044%40wp-shamsi&sfp_email=&sfph_mail=		Third Party Advisory
https://www.wordfence.com/threat-intel/vulnerabilities/id/7b498c5a-9fd1-43b8-b456-f6cec65d5077		Third Party Advisory
https://www.wordfence.com/threat-intel/vulnerabilities/id/7b498c5a-9fd1-43b8-b456-f6cec65d5077?source=cve