CVE-2022-1203
Last modified
CVE-2022-1203 is a medium-severity vulnerability rated 4.3/10 on the CVSS scale. The Content Mask WordPress plugin before 1.8.4.1 does not have authorisation and CSRF checks in various AJAX actions, as well as does not validate the option to be updated to ensure it belongs to the plugin. As a result, any authenticated user, such as subscriber could modify arbitrary blog options. EPSS estimates a 1.05% chance of exploitation in the next 30 days.
Description
The Content Mask WordPress plugin before 1.8.4.1 does not have authorisation and CSRF checks in various AJAX actions, as well as does not validate the option to be updated to ensure it belongs to the plugin. As a result, any authenticated user, such as subscriber could modify arbitrary blog options
Metrics
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Content Mask Project | Content Mask | < 1.8.4.1 |
References
- https://wpscan.com/vulnerability/3c9969e5-ca8e-4e5d-a482-c6b5c4257820Exploit, Third Party Advisory
- https://wpscan.com/vulnerability/3c9969e5-ca8e-4e5d-a482-c6b5c4257820Exploit, Third Party Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2022-1203?
How severe is CVE-2022-1203?
How do I fix CVE-2022-1203?
How Strix Helps
- Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2022
- CVE-2022-1196After a VR Process is destroyed, a reference to it may have …6.5
- CVE-2022-1197When importing a revoked key that specified key compromise a…5.4
- CVE-2022-1198A use-after-free vulnerabilitity was discovered in drivers/n…5.5
- CVE-2022-1199A flaw was found in the Linux kernel. This flaw allows an at…7.5
- CVE-2022-1201NULL Pointer Dereference in mrb_vm_exec with super in GitHub…6.5
- CVE-2022-1202The WP-CRM WordPress plugin through 1.2.1 does not validate …7.8
- CVE-2022-1204A use-after-free flaw was found in the Linux kernel’s Amateu…5.5
- CVE-2022-1205A NULL pointer dereference flaw was found in the Linux kerne…4.7
- CVE-2022-1206The AdRotate Banner Manager – The only ad manager you'll nee…7.2
- CVE-2022-1207Out-of-bounds read in GitHub repository radareorg/radare2 pr…6.6
- CVE-2022-1208The Ultimate Member plugin for WordPress is vulnerable to St…5.4
- CVE-2022-1209The Ultimate Member plugin for WordPress is vulnerable to ar…5.4
Are you affected by CVE-2022-1203?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST