CVE-2022-1573

CWE-352 — Cross-Site Request Forgery (CSRF)4 documents4 sources
Severity
4.3MEDIUM
EPSS
0.1%
top 71.86%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Unknown Html2wpHtml2wp Project Html2wp
Timeline
PublishedJun 27
Latest updateJun 30

Description

The HTML2WP WordPress plugin through 1.0.0 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:NExploitability: 2.8 | Impact: 1.4

Affected Packages2 packages

▶CVEListV5unknown/html2wp1.0.0 — 1.0.0

🔴Vulnerability Details

2
GHSA
GHSA-cfvp-c6qp-xjfq: The HTML2WP WordPress plugin through 1↗2022-06-28
▶
CVEList
HTML2WP <= 1.0.0 - Arbitrary Settings Update via CSRF↗2022-06-27
▶

🕵️Threat Intelligence

1
Talos
Vulnerability Spotlight: Command injection vulnerabilities in Robustel cellular router↗2022-06-30
▶
CVE-2022-1573 (MEDIUM CVSS 4.3) | The HTML2WP WordPress plugin throug | cvebase.io