PT-2022-14032 · WordPress · Stop Comment Spam

Daniel Ruf · Published 2022-08-29 · Updated 2022-09-01 · CVE-2022-1663

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Stop Spam Comments WordPress plugin versions 0.2.1.2 and earlier

Description The issue arises from the improper generation of the Javascript access token, which is intended to prevent abuse of the comment section. This allows threat authors to easily collect the value and add it to the request, potentially leading to unauthorized access or manipulation of comments.

Recommendations For versions 0.2.1.2 and earlier, consider disabling the comment section or restricting access to it until a proper fix is available. As a temporary workaround, restrict the use of the Javascript access token to minimize the risk of exploitation.

Exploit

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2022-1663

Affected Products

Stop Comment Spam

References · 5

• 🔥 https://wpscan.com/vulnerability/30820be1-e96a-4ff6-b1ec-efda14069e70 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2022-1663 · Security Note
• https://osv.dev/vulnerability/CVE-2022-1663 · Vendor Advisory
• https://t.me/cvenotify/35359 · Telegram Post
• https://t.me/cibsecurity/49004 · Telegram Post