CVE-2022-1625 New User Approve < 2.4 - Arbitrary Settings Update & Invitation Code Creation via CSRF
Attackers can trick admins into updating plugin settings or creating invitation codes, bypassing user approval restrictions.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2022-1625?
CVE-2022-1625 is a medium-severity vulnerability in Unknown New User Approve, published on 27 Jun 2022. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
The New User Approve WordPress plugin before 2.4 does not have CSRF check in place when updating its settings and adding invitation codes, which could allow attackers to add invitation codes (for bypassing the provided restrictions) and to change plugin settings by tricking admin users into visiting specially crafted websites.
Weakness: CWE-352
Which versions are affected by CVE-2022-1625?
It affects 1 product.
Products include Wpexperts New User Approve.
How do I fix CVE-2022-1625?
No fix has been published for CVE-2022-1625 yet. Limit exposure of the affected software until one is available.
Is CVE-2022-1625 being exploited?
There is no known exploitation of CVE-2022-1625 in the wild and no public exploit code.
Other vulnerabilities in Unknown New User Approve
Sources
Also known as GHSA-573v-fpj9-9qh6.