CVE-2022-1589

Change wp-admin Login < 1.1.0 - Unauthenticated Arbitrary Settings Update

published May 30, 2022

CVSS
—
EPSS
1%
Percentile
48.6
In the wild
Unconfirmed
What it is

The Change wp-admin login WordPress plugin before 1.1.0 does not properly check for authorisation and is also missing CSRF check when updating its settings, which could allow unauthenticated users to change the settings. The attacked could also be performed via a CSRF vector

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.00611 · 48.6th percentile
Published
2022-05-30T08:36Z
EPSS history
Timeline
  • 30 MAY 08:36Z
    Change wp-admin Login < 1.1.0 - Unauthenticated Arbitrary Settings Update
    cvelistv5