CVE-2022-3911: The iubenda WordPress plugin before 3.3.3 does does not have authorisation and CSRF in an AJAX action, and does not ensure that the options to be updated…

PriorityP273high8.8CVSS 3.1

AVNACLPRLUINSUCHIHAH

ITWVulnCheck KEV

Exploited in the wild

EPSS

0.46%

36.7th percentile

The iubenda WordPress plugin before 3.3.3 does does not have authorisation and CSRF in an AJAX action, and does not ensure that the options to be updated belong to the plugin as long as they are arrays. As a result, any authenticated users, such as subscriber can grant themselves any privileges, such as edit_plugins etc

Affected

1 ranges

Vendor	Product	Version range	Fixed in
iubenda	iubenda-cookie-law-solution	< 3.3.3	3.3.3

CVSS provenance

nvdv3.18.8HIGHCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

vulncheck8.8HIGH

CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.