PT-2022-27572 · WordPress · Wp Shamsi

Chloe Chamberland · Published 2022-12-16 · Updated 2022-12-20 · CVE-2022-4555

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L

Name of the Vulnerable Software and Affected Versions WP Shamsi plugin for WordPress versions up to, and including, 4.1.0

Description The WP Shamsi plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on the deactivate() function hooked via init(). This makes it possible for unauthenticated attackers to deactivate arbitrary plugins on the site, which can be used to deactivate security plugins and aid in exploiting other vulnerabilities.

Recommendations For WP Shamsi plugin for WordPress versions up to, and including, 4.1.0, update to a version higher than 4.1.0 to resolve the issue. As a temporary workaround, consider disabling the deactivate() function until a patch is available. Restrict access to the plugin's functionality to minimize the risk of exploitation.

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2022-4555

Affected Products

Wp Shamsi

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2022-4555 · Security Note
• https://osv.dev/vulnerability/CVE-2022-4555 · Vendor Advisory
• https://t.me/cvenotify/40053 · Telegram Post
• https://wordfence.com/threat-intel/vulnerabilities/id/7b498c5a-9fd1-43b8-b456-f6cec65d5077?source=cve · Note
• https://t.me/cvenotify/40247 · Telegram Post
• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2645044%40wp-shamsi&new=2645044%40wp-shamsi&sfp_email=&sfph_mail= · Note
• https://wordfence.com/threat-intel/vulnerabilities/id/7b498c5a-9fd1-43b8-b456-f6cec65d5077 · Note
• https://t.me/cibsecurity/54666 · Telegram Post