OpenCVE

The User Verification WordPress plugin before 1.0.94 was affected by an Auth Bypass security vulnerability. To bypass authentication, we only need to know the user’s username. Depending on whose username we know, which can be easily queried because it is usually public data, we may even be given an administrative role on the website.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

Vendors	Products
Pickplugins	User Verification

Configuration 1 [-]

cpe:2.3:a:pickplugins:user_verification:*:*:*:*:*:wordpress:*:*

No data.

References

Link	Providers
https://lana.codes/lanavdb/eeabe1d3-6f64-400a-8fb2-0865efdf6957
https://wpscan.com/vulnerability/1eee10a8-135f-4b76-8289-c381ff1f51ea

History

No history.

MITRE

Status: PUBLISHED

Assigner: WPScan

Published: 2023-01-23T14:31:53.721Z

Updated: 2024-08-03T01:48:39.545Z

Reserved: 2022-12-23T11:09:44.491Z

Link: CVE-2022-4693

Vulnrichment

No data.

NVD

Status : Modified

Published: 2023-01-23T15:15:16.190

Modified: 2024-11-21T07:35:44.850

Link: CVE-2022-4693

Redhat

No data.

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:pickplugins:user_verification:*:*:*:*:*:wordpress:*:*", "matchCriteriaId": "9AABDFAF-A75B-438D-AA4C-E1C2DA0D6745", "versionEndExcluding": "1.0.94", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "The User Verification WordPress plugin before 1.0.94 was affected by an Auth Bypass security vulnerability. To bypass authentication, we only need to know the user\u2019s username. Depending on whose username we know, which can be easily queried because it is usually public data, we may even be given an administrative role on the website."}, {"lang": "es", "value": "El complemento User Verification de WordPress anterior a la versi\u00f3n 1.0.94 se vio afectado por una vulnerabilidad de seguridad de Auth Bypass. Para evitar la autenticaci\u00f3n, s\u00f3lo necesitamos saber el nombre de usuario del usuario. Dependiendo de qu\u00e9 nombre de usuario conozcamos, que se puede consultar f\u00e1cilmente porque normalmente son datos p\u00fablicos, es posible que incluso se nos asigne una funci\u00f3n administrativa en el sitio web."}], "id": "CVE-2022-4693", "lastModified": "2024-11-21T07:35:44.850", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2023-01-23T15:15:16.190", "references": [{"source": "contact@wpscan.com", "tags": ["Exploit", "Third Party Advisory"], "url": "https://lana.codes/lanavdb/eeabe1d3-6f64-400a-8fb2-0865efdf6957"}, {"source": "contact@wpscan.com", "tags": ["Exploit", "Third Party Advisory"], "url": "https://wpscan.com/vulnerability/1eee10a8-135f-4b76-8289-c381ff1f51ea"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Exploit", "Third Party Advisory"], "url": "https://lana.codes/lanavdb/eeabe1d3-6f64-400a-8fb2-0865efdf6957"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Exploit", "Third Party Advisory"], "url": "https://wpscan.com/vulnerability/1eee10a8-135f-4b76-8289-c381ff1f51ea"}], "sourceIdentifier": "contact@wpscan.com", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-522"}], "source": "nvd@nist.gov", "type": "Primary"}]}