CVE-2022-3850
Last modified
CVE-2022-3850 is a medium-severity vulnerability rated 4.3/10 on the CVSS scale. The Find and Replace All WordPress plugin before 1.3 does not have CSRF check when replacing string, which could allow attackers to make a logged admin replace arbitrary string in database tables via a CSRF attack. EPSS estimates a 0.27% chance of exploitation in the next 30 days.
Description
The Find and Replace All WordPress plugin before 1.3 does not have CSRF check when replacing string, which could allow attackers to make a logged admin replace arbitrary string in database tables via a CSRF attack
Metrics
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Find And Replace All Project | Find And Replace All | <= 1.3 |
References
- https://wpscan.com/vulnerability/8ae42ec0-7e3a-4ea5-8e76-0aae7b92a8e9Exploit, Third Party Advisory
- https://wpscan.com/vulnerability/8ae42ec0-7e3a-4ea5-8e76-0aae7b92a8e9Exploit, Third Party Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2022-3850?
How severe is CVE-2022-3850?
How do I fix CVE-2022-3850?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2022
- CVE-2022-38491An issue was discovered in EasyVista 2020.2.125.3 and 2022.1…7.5
- CVE-2022-38492An issue was discovered in EasyVista 2020.2.125.3 and 2022.1…8.8
- CVE-2022-38493Rhonabwy 0.9.99 through 1.1.x before 1.1.7 doesn't check the…7.5
- CVE-2022-38495LIEF commit 365a16a was discovered to contain a heap-buffer …7.8
- CVE-2022-38496LIEF commit 365a16a was discovered to contain a reachable as…5.5
- CVE-2022-38497LIEF commit 365a16a was discovered to contain a segmentation…5.5
- CVE-2022-38509Wedding Planner v1.0 was discovered to contain a SQL injecti…9.8
- CVE-2022-38510Tenda_TX9pro V22.03.02.10 was discovered to contain a buffer…7.8
- CVE-2022-38511TOTOLINK A810R V5.9c.4050_B20190424 was discovered to contai…7.8
- CVE-2022-38512The Translation module in Liferay Portal v7.4.3.12 through v…6.5
- CVE-2022-3852The VR Calendar plugin for WordPress is vulnerable to Cross-…6.5
- CVE-2022-38527UCMS v1.6.0 was discovered to contain a cross-site scripting…6.1
Are you affected by CVE-2022-3850?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST