VULNERABILITY INTELLIGENCE

CVE-2022-4024

CVSS score6.5 MEDIUM
EPSS probability0.35%
CISA KEVNot currently listed
Published2022-12-19
Last modified2026-06-17
CVSS vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

Description

The Registration Forms WordPress plugin before 3.8.1.3 does not have authorisation and CSRF when deleting users via an init action handler, allowing unauthenticated attackers to delete arbitrary users (along with their posts)

Weakness classification

  • CWE-352: Cross-Site Request Forgery (CSRF)
  • CWE-862: Missing Authorization

Primary references