CVE-2022-42459 WordPress Image Hover Effects Ultimate plugin <= 9.7.1 - Auth. WordPress Options Change vulnerability
Authenticated users can modify WordPress options due to missing authorization checks in the Image Hover Effects Ultimate plugin.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2022-42459?
CVE-2022-42459 is a high-severity missing authorization vulnerability in Biplob Adhikari Image Hover Effects Ultimate (WordPress plugin), published on 18 Nov 2022. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
Auth. WordPress Options Change vulnerability in Image Hover Effects Ultimate plugin <= 9.7.1 on WordPress.
Which versions are affected by CVE-2022-42459?
It affects 1 product.
Products include Oxilab Image Hover Effects Ultimate.
How do I fix CVE-2022-42459?
No fix has been published for CVE-2022-42459 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2022-42459 being exploited?
There is no known exploitation of CVE-2022-42459 in the wild and no public exploit code.
Other vulnerabilities in Biplob Adhikari Image Hover Effects Ultimate (WordPress plugin)
- CVE-2022-2937 Image Hover Effects Ultimate <= 9.7.3 - Authenticated Stored Cross-Site Scripting via Title & Description
- CVE-2022-2935 Image Hover Effects Ultimate <= 9.7.3 - Authenticated Stored Cross-Site Scripting via Media URL
- CVE-2022-2936 Image Hover Effects Ultimate <= 9.7.3 - Authenticated Stored Cross-Site Scripting via Video Link
- CVE-2021-25031 Image Hover Effects Ultimate < 9.7.1 - Reflected Cross-Site Scripting
- CVE-2022-4207 Cross-site scripting in Image Hover Effects Ultimate (Image Gallery, Effects, Lightbox, Comparison or Magnifier)
Sources
Also known as GHSA-mrwc-4mgg-42c4.