CVE-2022-3419

MEDIUM

6.5

Descricao

The Automatic User Roles Switcher WordPress plugin before 1.1.2 does not have authorisation and proper CSRF checks, allowing any authenticated users like subscriber to add any role to themselves, such as administrator

Detalhes CVE

Pontuacao CVSS v3.16.5

SeveridadeMEDIUM

Vetor CVSSCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Vetor de ataqueNETWORK

ComplexidadeLOW

Privilegios necessariosLOW

Interacao do usuarioNONE

Publicado10/31/2022

Ultima modificacao5/6/2025

Fontenvd

Avistamentos honeypot0

Produtos afetados

addify:automatic_user_roles_switcher

Fraquezas (CWE)

CWE-269CWE-352

Referencias

https://wpscan.com/vulnerability/5909a423-9841-449c-a569-f687c609817b(contact@wpscan.com)

https://wpscan.com/vulnerability/5909a423-9841-449c-a569-f687c609817b(af854a3a-2127-422b-91ae-364da2661108)

Correlacoes IOC

Sem correlacoes registradas

This product uses data from the NVD API but is not endorsed or certified by the NVD.