CVE-2022-2355 — MEDIUM (6.5)

Q: What is CVE-2022-2355?

CVE-2022-2355 is a vulnerability with a CVSS score of 6.5 (MEDIUM). The Easy Username Updater WordPress plugin before 1.0.5 does not implement CSRF checks, which could allow attackers to make a logged in admin change any user's username includes the admin

Q: How severe is CVE-2022-2355?

CVE-2022-2355 has been rated MEDIUM with a CVSS base score of 6.5/10. Review the CVSS metrics above for detailed severity breakdown.

Q: Is there a patch for CVE-2022-2355?

Check the references section above for vendor advisories and patch information. Affected products include: Easy Username Updater Project Easy Username Updater.

Vulnerability Description

The Easy Username Updater WordPress plugin before 1.0.5 does not implement CSRF checks, which could allow attackers to make a logged in admin change any user's username includes the admin

CVSS Score

6.5

MEDIUM

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality

NONE

Integrity

HIGH

Availability

NONE

Affected Products

Vendor	Product	Versions
Easy Username Updater Project	Easy Username Updater	< 1.0.5

Related Weaknesses (CWE)

CWE-352

References

https://wpscan.com/vulnerability/426b5a0f-c16d-429a-9396-b3aea7922826ExploitThird Party Advisory
https://wpscan.com/vulnerability/426b5a0f-c16d-429a-9396-b3aea7922826ExploitThird Party Advisory

FAQ

What is CVE-2022-2355?

CVE-2022-2355 is a vulnerability with a CVSS score of 6.5 (MEDIUM). The Easy Username Updater WordPress plugin before 1.0.5 does not implement CSRF checks, which could allow attackers to make a logged in admin change any user's username includes the admin

How severe is CVE-2022-2355?

CVE-2022-2355 has been rated MEDIUM with a CVSS base score of 6.5/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2022-2355?

Check the references section above for vendor advisories and patch information. Affected products include: Easy Username Updater Project Easy Username Updater.