PT-2022-14061 · WordPress · Throws Spam Away

Daniel Ruf · Published 2022-06-06 · Updated 2022-06-15 · CVE-2022-1709

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Throws SPAM Away WordPress plugin versions prior to 3.3.1

Description The issue concerns a lack of CSRF checks when deleting comments, which can be either all, spam, or pending. This allows attackers to trick a logged-in admin into deleting comments via a CSRF attack.

Recommendations For versions prior to 3.3.1, update to version 3.3.1 or later to resolve the issue. As a temporary workaround, consider restricting access to comment deletion functionality to minimize the risk of exploitation.

Exploit

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2022-1709

Affected Products

Throws Spam Away

References · 4

• 🔥 https://wpscan.com/vulnerability/ac290535-d9ec-459a-abc3-27cd78eb54fc · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2022-1709 · Security Note
• https://osv.dev/vulnerability/CVE-2022-1709 · Vendor Advisory
• https://t.me/cibsecurity/43998 · Telegram Post