CVE-2022-0593 Login with phone number < 1.3.7 - Unauthenticated remote plugin deletion
Unauthenticated attackers can remotely delete plugin files due to missing authorization checks, causing a denial of service.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2022-0593?
CVE-2022-0593 is a medium-severity missing authorization vulnerability in Unknown Login with phone number, published on 14 Mar 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The Login with phone number WordPress plugin before 1.3.7 includes a file delete.php with no form of authentication or authorization checks placed in the plugin directory, allowing unauthenticated user to remotely delete the plugin files leading to a potential Denial of Service situation.
Weakness: CWE-73
Which versions are affected by CVE-2022-0593?
It affects 1 product.
Products include Idehweb Login With Phone Number.
How do I fix CVE-2022-0593?
No fix has been published for CVE-2022-0593 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2022-0593 being exploited?
There is no known exploitation of CVE-2022-0593 in the wild and no public exploit code.
Other vulnerabilities in Unknown Login with phone number
- CVE-2024-6482 Login with phone number <= 1.7.49 - Authenticated (Subscriber+) Authorization Bypass to Privilege Escalation
- CVE-2023-4916 Login with phone number <= 1.5.6 - Cross-Site Request Forgery to User Password Change
- CVE-2023-23492 SQL injection in Login with Phone Number WordPress Plugin
- CVE-2024-37429 WordPress Login with phone number plugin <= 1.7.35 - Admin+ Cross Site Scripting (XSS) vulnerability
- CVE-2022-0598 Login with phone number < 1.3.8 - Multiple Admin+ Stored XSS
Sources
Also known as GHSA-qr34-qw34-4824.