PT-2022-7074 · WordPress · Login As User/Customer

David · CVE-2022-4305 · Published 2022-12-27 · Updated 2023-01-30

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Login as User or Customer WordPress plugin versions prior to 3.3

Description The issue is related to insufficient authorization checks, which could allow unauthenticated attackers to obtain a valid admin session by logging in as another user. This could impact the integrity, availability, and confidentiality of protected information.

Recommendations For versions prior to 3.3, update to version 3.3 or later to resolve the issue. As a temporary workaround, consider disabling the plugin until a patch is available. Restrict access to sensitive areas of the WordPress site to minimize the risk of exploitation.

Exploit

Fix

Improper Privilege Management

Weakness Enumeration

CWE-269

CWE-264

Related Identifiers

BDU:2023-07497

CVE-2022-4305

Affected Products

Login As User/Customer

References · 7

• 🔥 https://wpscan.com/vulnerability/286d972d-7bda-455c-a226-fd9ce5f925bd · Exploit
• https://bdu.fstec.ru/vul/2023-07497 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2022-4305 · Security Note
• https://osv.dev/vulnerability/CVE-2022-4305 · Vendor Advisory
• https://github.com/advisories/GHSA-22mr-8pm7-gm4c · Note
• https://wordpress.org/plugins/login-as-customer-or-user/#developers · Note
• https://t.me/cibsecurity/56849 · Telegram Post