PT-2022-15551 · WordPress · Givewp

Raad Haddad · Published 2022-08-01 · Updated 2022-08-05 · CVE-2022-2260

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions GiveWP WordPress plugin versions prior to 2.21.3

Description The issue allows attackers to perform a Denial of Service (DoS) attack on the web server via a Cross-Site Request Forgery (CSRF) attack. This happens because the plugin lacks CSRF protection when exporting data and does not validate parameters such as dates. As a result, the plugin may attempt to retrieve data from the database multiple times, overwhelming the target's CPU.

Recommendations For versions prior to 2.21.3, update to version 2.21.3 or later to resolve the issue. As a temporary workaround, consider restricting access to the export functionality to minimize the risk of exploitation.

Exploit

Fix

DoS

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2022-2260

Affected Products

Givewp

References · 4

• 🔥 https://wpscan.com/vulnerability/831b3afa-8fa3-4cb7-8374-36d0c368292f · Exploit
• https://osv.dev/vulnerability/CVE-2022-2260 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-2260 · Security Note
• https://t.me/cibsecurity/47324 · Telegram Post