CVE-2022-29414 WordPress Subscribe To Comments Reloaded plugin <= 211130 - Multiple Cross-Site Request Forgery (CSRF) vulnerabilities
Attackers can trick users into modifying plugin settings, deleting subscriptions, or exposing system info via CSRF in Subscribe To Comments Reloaded.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2022-29414?
CVE-2022-29414 is a medium-severity vulnerability in WPKube Subscribe To Comments Reloaded (WordPress plugin), published on 29 Apr 2022. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
Multiple (13x) Cross-Site Request Forgery (CSRF) vulnerabilities in WPKube's Subscribe To Comments Reloaded plugin <= 211130 on WordPress allows attackers to clean up Log archive, download system info file, plugin system settings, plugin options settings, generate a new key, reset all options, change notifications settings, management page settings, comment form settings, manage subscriptions > mass update settings, manage subscriptions > add a new subscription, update subscription, delete Subscription.
Weakness: CWE-352
Which versions are affected by CVE-2022-29414?
It affects 1 product.
Products include Wpkube Subscribe to Comments Reloaded.
How do I fix CVE-2022-29414?
No fix has been published for CVE-2022-29414 yet. Limit exposure of the affected software until one is available.
Is CVE-2022-29414 being exploited?
There is no known exploitation of CVE-2022-29414 in the wild and no public exploit code.
Other vulnerabilities in WPKube Subscribe To Comments Reloaded (WordPress plugin)
Sources
Also known as GHSA-g87x-9qg3-cfrp.