CVE-2022-2276CWE-352CWE-862

WP Edit Menu < 1.5.0 - Unauthenticated Arbitrary Post Deletion

published August 22, 2022

CVSS
—
EPSS
0%
Percentile
34.4
In the wild
Unconfirmed
What it is

The WP Edit Menu WordPress plugin before 1.5.0 does not have authorisation and CSRF in an AJAX action, which could allow unauthenticated attackers to delete arbitrary posts/pages from the blog

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.00413 · 34.4th percentile
Weaknesses
CWE-352 · Cross-Site Request Forgery (CSRF); CWE-862 · Missing Authorization
Published
2022-08-22T15:00Z
EPSS history
Timeline
  • 22 AUG 15:00Z
    WP Edit Menu < 1.5.0 - Unauthenticated Arbitrary Post Deletion
    cvelistv5