CVE-2022-44595 WordPress WP2FA plugin <= 2.2.0 - Broken Authentication vulnerability
Attackers can bypass authentication in the WP 2FA plugin, potentially taking over user accounts without valid credentials.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2022-44595?
CVE-2022-44595 is a medium-severity authentication bypass vulnerability in Melapress WP 2FA, published on 21 Mar 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Improper Authentication vulnerability in Melapress WP 2FA allows Authentication Bypass.This issue affects WP 2FA: from n/a through 2.2.0.
Weakness: CWE-287
Which versions are affected by CVE-2022-44595?
It affects 1 product.
Products include Melapress Wp 2fa.
How do I fix CVE-2022-44595?
No fix has been published for CVE-2022-44595 yet. Limit exposure of the affected software until one is available.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2022-44595 being exploited?
There is no known exploitation of CVE-2022-44595 in the wild and no public exploit code.
Other vulnerabilities in Melapress WP 2FA
- CVE-2024-32568 WordPress WP 2FA plugin <= 2.6.2 - Reflected Cross Site Scripting (XSS) vulnerability
- CVE-2022-44587 WordPress WP 2FA plugin <= 2.6.3 - Sensitive Data Exposure via Log File vulnerability
- CVE-2023-6520 WP 2FA – Two-factor authentication for WordPress <= 2.5.0 - Cross-Site Request Forgery
Sources
Also known as GHSA-cg72-65f8-rpjf.