CVE-2022-4004

Donation Button <= 4.0.0 - Subscriber+ Broken Access Control leading to SMS Spam

Medium · published December 12, 2022

CVSS v3.1
4.3
EPSS
1%
Percentile
42.7
In the wild
Unconfirmed
What it is

The Donation Button WordPress plugin through 4.0.0 does not properly check for privileges and nonce tokens in its "donation_button_twilio_send_test_sms" AJAX action, which may allow any users with an account on the affected site, like subscribers, to use the plugin's Twilio integration to send SMSes to arbitrary phone numbers.

The record
Technical detail
CVSS v3.1
4.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00511 · 42.7th percentile
Published
2022-12-12T17:54Z
EPSS history
Timeline
  • 12 DEC 17:54Z
    Donation Button <= 4.0.0 - Subscriber+ Broken Access Control leading to SMS Spam
    cvelistv5