CVE-2022-1589 Change wp-admin Login < 1.1.0 - Unauthenticated Arbitrary Settings Update
Unauthenticated attackers can arbitrarily update plugin settings due to missing authorization and CSRF checks, potentially compromising site configuration.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2022-1589?
CVE-2022-1589 is a high-severity missing authorization vulnerability in Unknown Change wp-admin login, published on 30 May 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The Change wp-admin login WordPress plugin before 1.1.0 does not properly check for authorisation and is also missing CSRF check when updating its settings, which could allow unauthenticated users to change the settings. The attacked could also be performed via a CSRF vector
Which versions are affected by CVE-2022-1589?
It affects 1 product.
Products include Wpexperts All in One Login.
How do I fix CVE-2022-1589?
No fix has been published for CVE-2022-1589 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2022-1589 being exploited?
There is no known exploitation of CVE-2022-1589 in the wild and no public exploit code.
Other vulnerabilities in Unknown Change wp-admin login
Sources
Also known as GHSA-v43h-w929-q37g.