CVE-2022-0993CWE-285

SiteGround Security <= 1.2.5 - Authorization Weakness to Authentication Bypass

High · published April 19, 2022

CVSS v3.1
8.1
EPSS
8%
Percentile
94.5
In the wild
Unconfirmed
What it is

The SiteGround Security plugin for WordPress is vulnerable to authentication bypass that allows unauthenticated users to log in as administrative users due to missing identity verification on the 2FA back-up code implementation that logs users in upon success. This affects versions up to, and including, 1.2.5.

The record
Technical detail
CVSS v3.1
8.1 · HIGH
Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.07538 · 94.5th percentile
Weakness
CWE-285 · Improper Authorization
Published
2022-04-19T20:26Z
EPSS history
Timeline
  • 19 APR 20:26Z
    SiteGround Security <= 1.2.5 - Authorization Weakness to Authentication Bypass
    cvelistv5