CVE-2022-1895

The underConstruction WordPress plugin before 1.20 does not have CSRF check in place when deactivating the construction mode, which could allow attackers to make a logged in admin perform such action via a CSRF attack
References
Configurations

Configuration 1 (hide)

cpe:2.3:a:underconstruction_project:underconstruction:*:*:*:*:*:wordpress:*:*

History

28 Jun 2022, 17:00

Type Values Removed Values Added
First Time Underconstruction Project
Underconstruction Project underconstruction
CPE cpe:2.3:a:underconstruction_project:underconstruction:*:*:*:*:*:wordpress:*:*
References (MISC) https://wpscan.com/vulnerability/bd9ef7e0-ebbb-4b91-8c58-265218a3c536 - (MISC) https://wpscan.com/vulnerability/bd9ef7e0-ebbb-4b91-8c58-265218a3c536 - Exploit, Third Party Advisory
CVSS v2 : unknown
v3 : unknown
v2 : 4.3
v3 : 4.3

20 Jun 2022, 11:15

Type Values Removed Values Added
New CVE

Information

Published : 2022-06-20 11:15

Updated : 2023-12-10 14:22


NVD link : CVE-2022-1895

Mitre link : CVE-2022-1895

CVE.ORG link : CVE-2022-1895


JSON object : View

Products Affected

underconstruction_project

  • underconstruction
CWE
CWE-352

Cross-Site Request Forgery (CSRF)