PT-2022-13119 · WordPress · Customize Wordpress Emails/Alerts

Krzysztof Zając · Published 2022-02-28 · Updated 2023-08-02 · CVE-2022-0345

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions The Customize WordPress Emails and Alerts WordPress plugin versions prior to 1.8.7

Description The issue concerns a lack of authorization and CSRF check in the bnfw search users AJAX action. This allows any authenticated users to call the action and query for user e-mail prefixes, effectively finding the first letter, then the second one, then the third one, and so on.

Recommendations For versions prior to 1.8.7, update to version 1.8.7 or later to resolve the issue. As a temporary workaround, consider restricting access to the bnfw search users AJAX action to minimize the risk of exploitation.

Exploit

Fix

Missing Authorization

CSRF

Weakness Enumeration

CWE-862

CWE-352

Related Identifiers

CVE-2022-0345

Affected Products

Customize Wordpress Emails/Alerts

References · 4

• 🔥 https://wpscan.com/vulnerability/b3b523b9-6c92-4091-837a-d34e3174eb19 · Exploit
• https://osv.dev/vulnerability/CVE-2022-0345 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-0345 · Security Note
• https://t.me/cvenotify/55005 · Telegram Post