PT-2023-13697 · WordPress · Iubenda Wordpress Plugin

Krzysztof Zajac · Published 2023-01-02 · Updated 2025-04-10 · CVE-2022-3911

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions iubenda WordPress plugin versions prior to 3.3.3

Description The issue affects the iubenda WordPress plugin, where a lack of authorization and CSRF protection in an AJAX action, combined with insufficient validation of options to be updated, allows any authenticated user to grant themselves elevated privileges. This could include privileges such as edit plugins.

Recommendations For versions prior to 3.3.3, update to version 3.3.3 or later to resolve the issue. As a temporary workaround, consider restricting access to the AJAX action or ensuring that only trusted users have authenticated access to the system until the update can be applied.

Exploit

Fix

CSRF

Missing Authorization

Weakness Enumeration

CWE-352

CWE-862

Related Identifiers

CVE-2022-3911

Affected Products

Iubenda Wordpress Plugin

References · 6

• 🔥 https://wpscan.com/vulnerability/c47fdca8-74ac-48a4-9780-556927fb4e52 · Exploit
• https://osv.dev/vulnerability/CVE-2022-3911 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-3911 · Security Note
• https://t.me/cvenotify/118725 · Telegram Post
• https://t.me/cibsecurity/55770 · Telegram Post
• https://t.me/cvenotify/53645 · Telegram Post