Vulnerability Description
The iubenda WordPress plugin before 3.3.3 does does not have authorisation and CSRF in an AJAX action, and does not ensure that the options to be updated belong to the plugin as long as they are arrays. As a result, any authenticated users, such as subscriber can grant themselves any privileges, such as edit_plugins etc
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Iubenda | Iubenda-Cookie-Law-Solution | < 3.3.3 |
Related Weaknesses (CWE)
References
- https://wpscan.com/vulnerability/c47fdca8-74ac-48a4-9780-556927fb4e52ExploitThird Party Advisory
- https://wpscan.com/vulnerability/c47fdca8-74ac-48a4-9780-556927fb4e52ExploitThird Party Advisory
FAQ
What is CVE-2022-3911?
CVE-2022-3911 is a vulnerability with a CVSS score of 8.8 (HIGH). The iubenda WordPress plugin before 3.3.3 does does not have authorisation and CSRF in an AJAX action, and does not ensure that the options to be updated belong to the plugin as long as they are array...
How severe is CVE-2022-3911?
CVE-2022-3911 has been rated HIGH with a CVSS base score of 8.8/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2022-3911?
Check the references section above for vendor advisories and patch information. Affected products include: Iubenda Iubenda-Cookie-Law-Solution.