VULNERABILITY INTELLIGENCE

CVE-2022-3119

CVSS score7.5 HIGH
EPSS probability0.44%
CISA KEVNot currently listed
Published2022-09-26
Last modified2026-06-17
CVSS vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Description

The OAuth client Single Sign On WordPress plugin before 3.0.4 does not have authorisation and CSRF when updating its settings, which could allow unauthenticated attackers to update them and change the OAuth endpoints to ones they controls, allowing them to then be authenticated as admin if they know the correct email address

Weakness classification

  • CWE-287: Improper Authentication
  • CWE-352: Cross-Site Request Forgery (CSRF)

Primary references