VULNERABILITY INTELLIGENCE

CVE-2022-3419

CVSS score6.5 MEDIUM
EPSS probability0.41%
CISA KEVNot currently listed
Published2022-10-31
Last modified2026-06-17
CVSS vectorCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Description

The Automatic User Roles Switcher WordPress plugin before 1.1.2 does not have authorisation and proper CSRF checks, allowing any authenticated users like subscriber to add any role to themselves, such as administrator

Weakness classification

  • contact@wpscan.com: CWE-269

Primary references