PT-2022-13461 · WordPress · Amelia

Huli · Published 2022-04-04 · Updated 2023-08-02 · CVE-2022-0837

Positive Technologies (AI Summary)

CVSS v2.0

5.5

Medium

Base vector

AV:N/AC:L/Au:S/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions Amelia WordPress plugin versions prior to 1.0.48

Description The issue allows any customer to send paid test SMS notifications and retrieve sensitive information about the admin, such as email, account balance, and payment history. A malicious actor can abuse this to drain the account balance by sending SMS notifications.

Recommendations For versions prior to 1.0.48, update to version 1.0.48 or later to resolve the issue. As a temporary workaround, consider restricting access to the Amelia SMS service to prevent unauthorized use.

Exploit

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2022-0837

Affected Products

Amelia

References · 5

• 🔥 https://wpscan.com/vulnerability/0882e5c0-f319-4994-9346-aa18438fda6a · Exploit
• https://osv.dev/vulnerability/CVE-2022-0837 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-0837 · Security Note
• https://t.me/cvenotify/55054 · Telegram Post
• https://t.me/cvenotify/28746 · Telegram Post