PT-2022-17629 · WordPress · Auto-Hyperlink Urls

Daniel Ruf · Published 2022-08-22 · Updated 2022-08-23 · CVE-2022-2600

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Auto-hyperlink URLs WordPress plugin versions through 5.4.1

Description The issue allows for Tab Nabbing, giving the target site access to the source tab through the window.opener DOM object, because the plugin does not set rel="noopener noreferer" on generated links.

Recommendations For Auto-hyperlink URLs WordPress plugin versions through 5.4.1, consider updating to a version that includes the fix for this issue, which should set rel="noopener noreferer" on generated links to prevent Tab Nabbing.

Exploit

Fix

Weakness Enumeration

CWE-1022

Related Identifiers

CVE-2022-2600

Affected Products

Auto-Hyperlink Urls

References · 3

• 🔥 https://wpscan.com/vulnerability/01bbdefd-bdc3-43ef-9f35-6e7ebe786be2 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2022-2600 · Security Note
• https://osv.dev/vulnerability/CVE-2022-2600 · Vendor Advisory