CVE-2022-3911

iubenda < 3.3.3 - Subscriber+ Privileges Escalation to Admin

High · published January 2, 2023

CVSS v3.1
8.8
EPSS
0%
Percentile
39.5
In the wild
Unconfirmed
What it is

The iubenda WordPress plugin before 3.3.3 does does not have authorisation and CSRF in an AJAX action, and does not ensure that the options to be updated belong to the plugin as long as they are arrays. As a result, any authenticated users, such as subscriber can grant themselves any privileges, such as edit_plugins etc

The record
Technical detail
CVSS v3.1
8.8 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00467 · 39.5th percentile
Published
2023-01-02T21:49Z
EPSS history
Timeline
  • 02 JAN 21:49Z
    iubenda < 3.3.3 - Subscriber+ Privileges Escalation to Admin
    cvelistv5