CVE-2022-1589

{"id": "CVE-2022-1589", "cveTags": [], "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "[email protected]", "cvssData": {"version": "2.0", "baseScore": 5.0, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:N/I:P/A:N", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "LOW", "availabilityImpact": "NONE", "confidentialityImpact": "NONE"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV31": [{"type": "Primary", "source": "[email protected]", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 3.9}]}, "published": "2022-05-30T09:15:10.157", "references": [{"url": "https://wpscan.com/vulnerability/257f9e14-4f43-4852-8384-80c15d087633", "tags": ["Exploit", "Third Party Advisory"], "source": "[email protected]"}, {"url": "https://wpscan.com/vulnerability/257f9e14-4f43-4852-8384-80c15d087633", "tags": ["Exploit", "Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "[email protected]", "description": [{"lang": "en", "value": "CWE-352"}, {"lang": "en", "value": "CWE-863"}]}], "descriptions": [{"lang": "en", "value": "The Change wp-admin login WordPress plugin before 1.1.0 does not properly check for authorisation and is also missing CSRF check when updating its settings, which could allow unauthenticated users to change the settings. The attacked could also be performed via a CSRF vector"}, {"lang": "es", "value": "El plugin Change wp-admin de WordPress versiones anteriores a 1.1.0, no comprueba apropiadamente la autorizaci\u00f3n y tampoco comprueba CSRF cuando es actualizada su configuraci\u00f3n, lo que podr\u00eda permitir a usuarios no autenticados cambiar la configuraci\u00f3n. El ataque tambi\u00e9n podr\u00eda llevarse a cabo por medio de un vector de tipo CSRF"}], "lastModified": "2026-01-14T18:58:52.957", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:wpexperts:all_in_one_login:*:*:*:*:-:wordpress:*:*", "vulnerable": true, "matchCriteriaId": "45022CFC-8F1C-4131-B1DD-B3AEA77DE807", "versionEndExcluding": "1.1.0"}], "operator": "OR"}]}], "sourceIdentifier": "[email protected]"}