CVE-2022-0229

miniOrange's Google Authenticator < 5.5 - Unauthenticated Arbitrary Options Deletion

published March 21, 2022

CVSS
—
EPSS
1%
Percentile
45.2
In the wild
Unconfirmed
What it is

The miniOrange's Google Authenticator WordPress plugin before 5.5 does not have proper authorisation and CSRF checks when handling the reconfigureMethod, and does not validate the parameters passed to it properly. As a result, unauthenticated users could delete arbitrary options from the blog, making it unusable.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.00549 · 45.2th percentile
Published
2022-03-21T18:55Z
EPSS history
Timeline
  • 21 MAR 18:55Z
    miniOrange's Google Authenticator < 5.5 - Unauthenticated Arbitrary Options Deletion
    cvelistv5