Vulnerability Description
The SiteGround Security plugin for WordPress is vulnerable to authentication bypass that allows unauthenticated users to log in as administrative users due to missing identity verification on the 2FA back-up code implementation that logs users in upon success. This affects versions up to, and including, 1.2.5.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Siteground | Siteground Security | <= 1.2.5 |
Related Weaknesses (CWE)
References
- https://plugins.trac.wordpress.org/changeset/2706302Release NotesVendor Advisory
- https://www.wordfence.com/blog/2022/04/critical-authentication-bypass-vulnerabil
- https://www.wordfence.com/threat-intel/vulnerabilities/id/8e3a5566-eee5-4f71-9c9
- https://plugins.trac.wordpress.org/changeset/2706302Release NotesVendor Advisory
- https://www.wordfence.com/blog/2022/04/critical-authentication-bypass-vulnerabil
- https://www.wordfence.com/threat-intel/vulnerabilities/id/8e3a5566-eee5-4f71-9c9
FAQ
What is CVE-2022-0993?
CVE-2022-0993 is a vulnerability with a CVSS score of 8.1 (HIGH). The SiteGround Security plugin for WordPress is vulnerable to authentication bypass that allows unauthenticated users to log in as administrative users due to missing identity verification on the 2FA ...
How severe is CVE-2022-0993?
CVE-2022-0993 has been rated HIGH with a CVSS base score of 8.1/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2022-0993?
Check the references section above for vendor advisories and patch information. Affected products include: Siteground Siteground Security.