CVE-2022-1749

The WPMK Ajax Finder WordPress plugin is vulnerable to Cross-Site Request Forgery via the createplugin_atf_admin_setting_page() function found in the ~/inc/config/create-plugin-config.php file due to a missing nonce check which allows attackers to inject arbitrary web scripts, in versions up to and including 1.0.1.

• CWE-352
• CWE-352
• CWE-352

• https://plugins.trac.wordpress.org/browser/find-any-think/trunk/inc/config/create-plugin-admin.phpExploit, Third Party Advisory
• https://www.wordfence.com/threat-intel/vulnerabilities/id/1d063d01-5f67-4c7f-ab71-01708456e82b?source=cveThird Party Advisory
• https://www.wordfence.com/vulnerability-advisories/#CVE-2022-1749Third Party Advisory
• https://plugins.trac.wordpress.org/browser/find-any-think/trunk/inc/config/create-plugin-admin.phpExploit, Third Party Advisory
• https://www.wordfence.com/threat-intel/vulnerabilities/id/1d063d01-5f67-4c7f-ab71-01708456e82b?source=cveThird Party Advisory
• https://www.wordfence.com/vulnerability-advisories/#CVE-2022-1749Third Party Advisory

Published

Jun 13, 2022

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-1743The tested version of Dominion Voting System ImageCast X can…6.8
• CVE-2022-1744Applications on the tested version of Dominion Voting System…6.8
• CVE-2022-1745The authentication mechanism used by technicians on the test…6.8
• CVE-2022-1746The authentication mechanism used by poll workers to adminis…7.6
• CVE-2022-1747The authentication mechanism used by voters to activate a vo…4.6
• CVE-2022-1748Softing OPC UA C++ Server SDK, Secure Integration Server, ed…7.5
• CVE-2022-1750The Sticky Popup plugin for WordPress is vulnerable to Store…4.8
• CVE-2022-1751The Skitter Slideshow plugin for WordPress is vulnerable to …7.2
• CVE-2022-1752Unrestricted Upload of File with Dangerous Type in GitHub re…8
• CVE-2022-1753A vulnerability, which was classified as critical, was found…4.3
• CVE-2022-1754Integer Overflow or Wraparound in GitHub repository polonel/…6.5
• CVE-2022-1755The SVG Support WordPress plugin before 2.5 does not properl…5.4