CVE-2022-4555

The WP Shamsi plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on the deactivate() function hooked via init() in versions up to, and including, 4.1.0. This makes it possible for unauthenticated attackers to deactivate arbitrary plugins on the site. This can be used to deactivate security plugins that aids in exploiting other vulnerabilities.

• CWE-862

• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2645044%40wp-shamsi&new=2645044%40wp-shamsi&sfp_email=&sfph_mail=Third Party Advisory
• https://www.wordfence.com/threat-intel/vulnerabilities/id/7b498c5a-9fd1-43b8-b456-f6cec65d5077?source=cve
• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2645044%40wp-shamsi&new=2645044%40wp-shamsi&sfp_email=&sfph_mail=Third Party Advisory
• https://www.wordfence.com/threat-intel/vulnerabilities/id/7b498c5a-9fd1-43b8-b456-f6cec65d5077Third Party Advisory

Published

Dec 16, 2022

Last Modified

Jun 17, 2026

Status

Modified

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-45541EyouCMS <= 1.6.0 was discovered a reflected-XSS in the artic…6.1
• CVE-2022-45542EyouCMS <= 1.6.0 was discovered a reflected-XSS in the FileM…5.4
• CVE-2022-45543Cross site scripting (XSS) vulnerability in DiscuzX 3.4 allo…6.1
• CVE-2022-45544Insecure Permission vulnerability in Schlix Web Inc SCHLIX C…8.8
• CVE-2022-45546Information Disclosure in Authentication Component of Screen…7.5
• CVE-2022-45548AyaCMS v3.1.2 has an Arbitrary File Upload vulnerability.8.8
• CVE-2022-45550AyaCMS 3.1.2 is vulnerable to Remote Code Execution (RCE).9.8
• CVE-2022-45551An issue discovered in Shenzhen Zhiboton Electronics ZBT WE1…9.8
• CVE-2022-45552An Insecure Permissions vulnerability in Shenzhen Zhiboton E…7.5
• CVE-2022-45553An issue discovered in Shenzhen Zhibotong Electronics WBT WE…9.8
• CVE-2022-45557Cross site scripting (XSS) vulnerability in Hundredrabbits L…6.1
• CVE-2022-45558Cross site scripting (XSS) vulnerability in Hundredrabbits L…6.1