PT-2022-24177 · WordPress · Wp Shamsi

Muhammad Daffa · Published 2022-09-09 · Updated 2023-07-21 · CVE-2022-38058

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions WP Shamsi plugin versions <= 4.1.1

Description The issue is related to an authenticated plugin setting change vulnerability. This means that an attacker with subscriber or higher privileges can change plugin settings. The estimated number of potentially affected devices worldwide is not specified.

Recommendations For WP Shamsi plugin versions <= 4.1.1, update to a version greater than 4.1.1 to resolve the issue.

Fix

Weakness Enumeration

CWE-264

Related Identifiers

CVE-2022-38058

Affected Products

Wp Shamsi

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2022-38058 · Security Note
• https://osv.dev/vulnerability/CVE-2022-38058 · Vendor Advisory
• https://patchstack.com/database/vulnerability/wp-shamsi/wordpress-wp-shamsi-plugin-4-1-1-authenticated-plugin-setting-change-vulnerability/_s_id=cve · Note
• https://t.me/cibsecurity/49505 · Telegram Post
• https://wordpress.org/plugins/wp-shamsi/#developers · Note