WP Maintenance Mode & Coming Soon < 2.4.5 - Subscribed Users Deletion via CSRF
CVE-2022-1576

6.5MEDIUM

Key Information:

Vendor
Wordpress
Status
WP Maintenance Mode & Coming Soon
Vendor
CVE Published:
11 July 2022

Summary

The WP Maintenance Mode & Coming Soon WordPress plugin before 2.4.5 is lacking CSRF when emptying the subscribed users list, which could allow attackers to make a logged in admin perform such action via a CSRF attack

Affected Version(s)

WP Maintenance Mode & Coming Soon 2.0.4 < 2.0.4*

WP Maintenance Mode & Coming Soon 2.4.5

References

https://wpscan.com/vulnerability/68deab46-1c16-46ae-a912-...
x_refsource_MISC

CVSS V3.1

Score:
6.5
Severity:
MEDIUM
Confidentiality:
None
Integrity:
High
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Daniel Ruf
.