CVE-2022-1967CWE-352

WP Championship < 9.3 - Multiple CSRF

published July 4, 2022

CVSS
—
EPSS
1%
Percentile
43.5
In the wild
Unconfirmed
What it is

The WP Championship WordPress plugin before 9.3 is lacking CSRF checks in various places, allowing attackers to make a logged in admin perform unwanted actions, such as create and delete arbitrary teams as well as update the plugin's settings. Due to the lack of sanitisation and escaping, it could also lead to Stored Cross-Site Scripting issues

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.00523 · 43.5th percentile
Weakness
CWE-352 · Cross-Site Request Forgery (CSRF)
Published
2022-07-04T13:05Z
EPSS history
Timeline
  • 04 JUL 13:05Z
    WP Championship < 9.3 - Multiple CSRF
    cvelistv5