PT-2022-13996 · WordPress · Admin Management Xtended

Daniel Ruf · Published 2022-07-11 · Updated 2022-07-15 · CVE-2022-1599

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions Admin Management Xtended WordPress plugin versions prior to 2.4.5

Description The issue allows attackers to make logged-in users with the right capabilities call certain AJAX actions without proper CSRF checks. This can lead to unauthorized changes in post status, slug, post date, comment status, and more.

Recommendations For versions prior to 2.4.5, update to version 2.4.5 or later to resolve the issue. As a temporary workaround, consider restricting access to the AJAX actions that are missing CSRF checks until a patch is applied.

Exploit

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2022-1599

Affected Products

Admin Management Xtended

References · 4

• 🔥 https://wpscan.com/vulnerability/4a36e876-7e3b-4a81-9f16-9ff5fbb20dd6 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2022-1599 · Security Note
• https://osv.dev/vulnerability/CVE-2022-1599 · Vendor Advisory
• https://t.me/cibsecurity/45912 · Telegram Post