PT-2022-13577 · Siteground · Siteground Security Plugin

Chloe Chamberland · Published 2022-04-19 · Updated 2023-10-24 · CVE-2022-0992

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions SiteGround Security plugin for WordPress versions up to, and including, 1.2.5

Description The issue allows unauthenticated users to log in as administrative users due to missing identity verification on initial 2FA set-up. This enables unauthenticated and unauthorized users to configure 2FA for pending accounts. Upon successful configuration, the attacker is logged in as that user without access to a username/password pair, which is the expected first form of authentication.

Recommendations For versions up to, and including, 1.2.5, update to a version that includes a fix for this issue to prevent authentication bypass. As a temporary workaround, consider disabling the 2FA set-up feature until a patch is available.

Exploit

Fix

Missing Authentication

Authentication Bypass Using an Alternate Path or Channel

Weakness Enumeration

CWE-306

CWE-288

Related Identifiers

CVE-2022-0992

Affected Products

Siteground Security Plugin

References · 6

• 🔥 https://wordfence.com/blog/2022/04/critical-authentication-bypass-vulnerability-patched-in-siteground-security-plugin · Exploit
• https://osv.dev/vulnerability/CVE-2022-0992 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-0992 · Security Note
• https://plugins.trac.wordpress.org/changeset/2706302 · Vendor Advisory
• https://t.me/cvenotify/54876 · Telegram Post
• https://wordfence.com/threat-intel/vulnerabilities/id/6e5c6bf7-a653-4571-9566-574d2bb35c4f?source=cve · Note