PT-2023-13697 · WordPress · Iubenda Wordpress Plugin

Krzysztof Zajac · Publicado 2023-01-02 · Atualizado 2025-04-10 · CVE-2022-3911

Positive Technologies (AI Summary)

CVSS v3.1

8.8

Alta

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions iubenda WordPress plugin versions prior to 3.3.3

Description The issue affects the iubenda WordPress plugin, where a lack of authorization and CSRF protection in an AJAX action, combined with insufficient validation of options to be updated, allows any authenticated user to grant themselves elevated privileges. This could include privileges such as edit plugins.

Recommendations For versions prior to 3.3.3, update to version 3.3.3 or later to resolve the issue. As a temporary workaround, consider restricting access to the AJAX action or ensuring that only trusted users have authenticated access to the system until the update can be applied.

Exploit

Correção

CSRF

Missing Authorization

Enumeração de Fraquezas

CWE-352

CWE-862

Identificadores relacionados

CVE-2022-3911

Produtos afetados

Iubenda Wordpress Plugin

Referências · 6

• 🔥 https://wpscan.com/vulnerability/c47fdca8-74ac-48a4-9780-556927fb4e52 · Exploit
• https://osv.dev/vulnerability/CVE-2022-3911 · Aviso do Fabricante
• https://t.me/cvenotify/118725 · Publicação no Telegram
• https://t.me/cibsecurity/55770 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2022-3911 · Nota de Segurança
• https://t.me/cvenotify/53645 · Publicação no Telegram