CVE-2022-2449CWE-352

reSmush.it Image Optimizer < 0.4.7 - Multiple CSRF

Medium · published November 14, 2022

CVSS v3.1
6.5
EPSS
0%
Percentile
27.9
In the wild
Unconfirmed
What it is

The reSmush.it : the only free Image Optimizer & compress plugin WordPress plugin before 0.4.4 does not perform CSRF checks for any of its AJAX actions, allowing an attackers to trick logged in users to perform various actions on their behalf on the site.

The record
Technical detail
CVSS v3.1
6.5 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
CVSS v4.0
Not supplied
EPSS
0.00354 · 27.9th percentile
Weakness
CWE-352 · Cross-Site Request Forgery (CSRF)
Published
2022-11-14T00:00Z
EPSS history
Timeline
  • 14 NOV 00:00Z
    reSmush.it Image Optimizer < 0.4.7 - Multiple CSRF
    cvelistv5