Cross-Site Request Forgery Vulnerability in Chained Quiz Plugin for WordPress
CVE-2022-4219

5.4MEDIUM

Key Information:

Vendor

Wordpress
Status
Chained Quiz
Vendor
CVE Published:
2 December 2022

What is CVE-2022-4219?

The Chained Quiz plugin for WordPress is susceptible to Cross-Site Request Forgery (CSRF), affecting all versions up to and including 1.3.2.4. The vulnerability arises from the absence of nonce validation in the manage() function, which allows unauthenticated attackers to exploit this weakness. By tricking a site administrator into clicking a malicious link, the attacker could initiate unauthorized actions, such as deleting submitted quiz responses, posing a significant risk to the integrity of user-submitted data.

Affected Version(s)

Chained Quiz * <= 1.3.2.4

References

https://plugins.trac.wordpress.org/changeset?sfp_email=&s...
https://gist.github.com/Xib3rR4dAr/417a11bcb9b8da28cfe5ba...
https://www.wordfence.com/vulnerability-advisories-contin...

CVSS V3.1

Score:
5.4
Severity:
MEDIUM
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Muhammad Zeeshan (Xib3rR4dAr)
.
The Cyber Security Vulnerability Database.