PT-2022-14005 · WordPress · Bulk Page Creator

Daniel Ruf · Published 2022-05-30 · Updated 2022-06-08 · CVE-2022-1611

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Bulk Page Creator WordPress plugin versions prior to 1.1.4

Description The issue concerns the lack of nonce checks for page creation functionalities, making them susceptible to Cross-Site Request Forgery (CSRF) attacks. CSRF is a type of attack where an attacker tricks a user into performing unintended actions on a web application that the user is authenticated to. In this context, it means an attacker could potentially create pages without the user's knowledge or consent.

Recommendations For versions prior to 1.1.4, update to version 1.1.4 or later to resolve the issue. As a temporary workaround, consider restricting access to the page creation functionalities until the update can be applied.

Exploit

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2022-1611

Affected Products

Bulk Page Creator

References · 4

• 🔥 https://wpscan.com/vulnerability/3843b867-7784-4976-b5ab-8a1e7d45618a · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2022-1611 · Security Note
• https://osv.dev/vulnerability/CVE-2022-1611 · Vendor Advisory
• https://t.me/cibsecurity/43545 · Telegram Post