PT-2022-13457 · WordPress · Church Admin

Cydave · Published 2022-03-28 · Updated 2023-07-05 · CVE-2022-0833

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Church Admin WordPress plugin versions prior to 3.4.135

Description The issue allows unauthenticated attackers to exploit the lack of authorization and CSRF protection in certain actions and requested files. This enables them to repeatedly request the "refresh-backup" action and simultaneously access a publicly accessible temporary file generated by the plugin, ultimately disclosing the final backup filename. The attacker can then fetch this filename to download the backup of the plugin's database data.

Recommendations For versions prior to 3.4.135, update to version 3.4.135 or later to resolve the issue. As a temporary workaround, consider restricting access to the plugin's actions and requested files to prevent unauthorized requests.

Exploit

Fix

Missing Authorization

CSRF

Weakness Enumeration

CWE-862

CWE-352

Related Identifiers

CVE-2022-0833

Affected Products

Church Admin

References · 4

• 🔥 https://wpscan.com/vulnerability/b2c7c1e8-d72c-4b1e-b5cb-dc2a6538965d · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2022-0833 · Security Note
• https://osv.dev/vulnerability/CVE-2022-0833 · Vendor Advisory
• https://t.me/cibsecurity/39672 · Telegram Post