CVE-2022-40310 WordPress Rate my Post – WP Rating System plugin <= 3.3.4 - Race Condition vulnerability

Q: What is CVE-2022-40310?

CVE-2022-40310 is a medium-severity vulnerability in Blaz K. Rate my Post – WP Rating System (WordPress plugin), published on 23 Sep 2022. Any signed-in user can exploit it over the network, with no action from the victim.

Q: Is CVE-2022-40310 being exploited?

There is no known exploitation of CVE-2022-40310 in the wild and no public exploit code.

Q: How do I fix CVE-2022-40310?

No fix has been published for CVE-2022-40310 yet. Limit exposure of the affected software until one is available.

Medium 4.3 Published 23 Sep 2022 Updated 28 Apr 2026

Authenticated attackers can exploit a race condition to arbitrarily increase or decrease post ratings in the WP Rating System plugin.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2022-40310?

CVE-2022-40310 is a medium-severity vulnerability in Blaz K. Rate my Post – WP Rating System (WordPress plugin), published on 23 Sep 2022. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

Authenticated (subscriber+) Race Condition vulnerability in Rate my Post – WP Rating System plugin <= 3.3.4 at WordPress allows attackers to increase/decrease votes.

Weakness: CWE-362

Which versions are affected by CVE-2022-40310?

It affects 1 product.

Products include Blazzdev Rate My Post - Wp Rating System.

How do I fix CVE-2022-40310?

No fix has been published for CVE-2022-40310 yet. Limit exposure of the affected software until one is available.

Is CVE-2022-40310 being exploited?

There is no known exploitation of CVE-2022-40310 in the wild and no public exploit code.

CVE-2022-40671 WordPress Rate my Post – WP Rating System plugin <= 3.3.4 - Cross-Site Request Forgery (CSRF) vulnerability Medium 4.3

Sources

Also known as GHSA-wgh8-h75r-c4qw.