by Kastro
Paper/Archive/CVE-2022-4305

CVE-2022-4305

Unknown Login as User or Customer — Login as User or Customer < 3.3 - Unauthenticated Privilege Escalation to Admin

EPSS 39%public exploitCVSS 9.8
critical.is priorityof 100
59
CVSS 9.8 (NVD, ADP agree)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 98.6.986 × 2019.7Exploit: SSVC poc+1010.0SSVC exploitation: poc+100.0
Description · from the CVE record

The Login as User or Customer WordPress plugin before 3.3 lacks authorization checks to ensure that users are allowed to log in as another one, which could allow unauthenticated attackers to obtain a valid admin session.

Affected

ProductAffectedFixed inSource
Login as User or Customer< 3.33.3CNA

Scores by source

CISA ADP9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA ADPSSVCExploitation: poc · Automatable: no · Technical impact: partial

References

exploitwpscan.com/vulnerability/286d972d-7bda-455c-a226-fd9ce5f925bd