CVE-2022-0188 Coming Soon & Maintenance Plugin by NiteoThemes < 4.0.19 - Unauthenticated Arbitrary CSS Update

Q: What is CVE-2022-0188?

CVE-2022-0188 is a medium-severity missing authorization vulnerability in Unknown CMP, published on 14 Feb 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.

Q: Is CVE-2022-0188 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2022-0188 exists.

Q: How do I fix CVE-2022-0188?

No fix has been published for CVE-2022-0188 yet. Limit exposure of the affected software until one is available.

Medium 5.3 Published 14 Feb 2022 Updated 2 Aug 2024

Unauthenticated attackers can arbitrarily modify the coming soon page layout in the CMP WordPress plugin due to missing authorization checks.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2022-0188?

CVE-2022-0188 is a medium-severity missing authorization vulnerability in Unknown CMP, published on 14 Feb 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

The CMP WordPress plugin before 4.0.19 allows any user, even not logged in, to arbitrarily change the coming soon page layout.

Weakness: CWE-306

Which versions are affected by CVE-2022-0188?

It affects 1 product.

Products include Niteothemes Cmp.

How do I fix CVE-2022-0188?

No fix has been published for CVE-2022-0188 yet. Limit exposure of the affected software until one is available.

Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.

Is CVE-2022-0188 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2022-0188 exists.

Public exploit code: 1 Nuclei template.

Sources

Also known as GHSA-3rrw-2rpr-xr39.