CVE-2022-1599CWE-352

Admin Management Xtended < 2.4.5 - Post Visibility/Date/Comment Status Update via CSRF

published July 11, 2022

CVSS
—
EPSS
1%
Percentile
53.1
In the wild
Unconfirmed
What it is

The Admin Management Xtended WordPress plugin before 2.4.5 does not have CSRF checks in some of its AJAX actions, allowing attackers to make a logged users with the right capabilities to call them. This can lead to changes in post status (draft, published), slug, post date, comment status (enabled, disabled) and more.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.00713 · 53.1th percentile
Weakness
CWE-352 · Cross-Site Request Forgery (CSRF)
Published
2022-07-11T12:56Z
EPSS history
Timeline
  • 11 JUL 12:56Z
    Admin Management Xtended < 2.4.5 - Post Visibility/Date/Comment Status Update via CSRF
    cvelistv5