CVE-2022-3880 AntiHacker < 4.20 - Subscriber+ Arbitrary Plugin Installation
Authenticated subscribers can install and activate arbitrary plugins due to missing authorization and CSRF checks in an AJAX action.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2022-3880?
CVE-2022-3880 is a medium-severity missing authorization vulnerability in Unknown Disable Json API, Login Lockdown, XMLRPC, Pingback, Stop User Enumeration Anti Hacker Scan, published on 12 Dec 2022. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
The Disable Json API, Login Lockdown, XMLRPC, Pingback, Stop User Enumeration Anti Hacker Scan WordPress plugin before 4.20 does not have proper authorisation and CSRF in an AJAX action, allowing any authenticated users, such as subscriber to call it and install and activate arbitrary plugins from wordpress.org
Which versions are affected by CVE-2022-3880?
It affects 1 product.
Products include Antihacker Project Antihacker.
How do I fix CVE-2022-3880?
No fix has been published for CVE-2022-3880 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2022-3880 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2022-3880 exists.
Sources
Also known as GHSA-cm69-gc59-36qm.