PT-2022-13091 · WordPress · Anycomment

Brandon Roldan · Published 2022-02-21 · Updated 2022-02-28 · CVE-2022-0279

Positive Technologies (AI Summary)

CVSS v2.0

3.5

Low

Base vector

AV:N/AC:M/Au:S/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions AnyComment WordPress plugin versions prior to 0.2.18

Description The issue is related to a race condition that occurs when liking or disliking a comment or reply. This could allow any authenticated user to quickly increase their own rating or decrease the rating of other users.

Recommendations For versions prior to 0.2.18, update to version 0.2.18 or later to resolve the issue. As a temporary workaround, consider restricting the like/dislike functionality to minimize the risk of exploitation.

Exploit

Fix

Race Condition

Weakness Enumeration

CWE-362

Related Identifiers

CVE-2022-0279

Affected Products

Anycomment

References · 4

• 🔥 https://wpscan.com/vulnerability/43a4b2d3-1bd5-490c-982c-bb7120595865 · Exploit
• https://osv.dev/vulnerability/CVE-2022-0279 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-0279 · Security Note
• https://t.me/cvenotify/27132 · Telegram Post