AnyComment < 0.2.18 - Arbitrary HyperComments Import/Revert via CSRF
CVE-2022-0134

8.8HIGH

Key Information:

Vendor

Wordpress
Status
Anycomment
Vendor
CVE Published:
21 February 2022

What is CVE-2022-0134?

The AnyComment WordPress plugin before 0.2.18 does not have CSRF checks in the Import and Revert HyperComments features, allowing attackers to make logged in admin perform such actions via a CSRF attack

Affected Version(s)

AnyComment 0.2.18

References

https://wpscan.com/vulnerability/fa09ea9b-d5a0-4773-a692-...
x_refsource_MISC

CVSS V3.1

Score:
8.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Brandon Roldan
.