PT-2022-14165 · WordPress · Rotating Posts

Daniel Ruf · Published 2022-06-27 · Updated 2022-07-06 · CVE-2022-1847

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Rotating Posts WordPress plugin versions prior to 1.12

Description The issue concerns the lack of a CSRF check when updating settings, which could allow attackers to make a logged-in admin change them via a CSRF attack.

Recommendations For Rotating Posts WordPress plugin versions prior to 1.12, update to version 1.12 or later to include the CSRF check and prevent potential setting changes via CSRF attacks.

Exploit

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2022-1847

Affected Products

Rotating Posts

References · 3

• 🔥 https://wpscan.com/vulnerability/d34ed713-4cca-4cef-b431-f132f1b10aa6 · Exploit
• https://osv.dev/vulnerability/CVE-2022-1847 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-1847 · Security Note