VULNERABILITY INTELLIGENCE

CVE-2022-0229

CVSS score8.1 HIGH
EPSS probability0.55%
CISA KEVNot currently listed
Published2022-03-21
Last modified2026-06-17
CVSS vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H

Description

The miniOrange's Google Authenticator WordPress plugin before 5.5 does not have proper authorisation and CSRF checks when handling the reconfigureMethod, and does not validate the parameters passed to it properly. As a result, unauthenticated users could delete arbitrary options from the blog, making it unusable.

Weakness classification

  • CWE-352: Cross-Site Request Forgery (CSRF)
  • CWE-862: Missing Authorization

Primary references