1. Home
  2. CVE Database
  3. CVE-2022-1589
HIGH · 7.5

CVE-2022-1589

The Change wp-admin login WordPress plugin before 1.1.0 does not properly check for authorisation and is also missing CSRF check when updating its settings, which could allow unauthenticated users to ...

Vulnerability Description

The Change wp-admin login WordPress plugin before 1.1.0 does not properly check for authorisation and is also missing CSRF check when updating its settings, which could allow unauthenticated users to change the settings. The attacked could also be performed via a CSRF vector

CVSS Score

7.5

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality
NONE
Integrity
HIGH
Availability
NONE

Affected Products

VendorProductVersions
WpexpertsAll In One Login< 1.1.0

Related Weaknesses (CWE)

CWE-863CWE-352

References

FAQ

What is CVE-2022-1589?

CVE-2022-1589 is a vulnerability with a CVSS score of 7.5 (HIGH). The Change wp-admin login WordPress plugin before 1.1.0 does not properly check for authorisation and is also missing CSRF check when updating its settings, which could allow unauthenticated users to ...

How severe is CVE-2022-1589?

CVE-2022-1589 has been rated HIGH with a CVSS base score of 7.5/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2022-1589?

Check the references section above for vendor advisories and patch information. Affected products include: Wpexperts All In One Login.