Vulnerability · Published Apr 19, 2022 · Assigned by Wordfence
CVE-2022-0993SiteGround Security <= 1.2.5 - Authorization Weakness to Authentication Bypass
High 8.1
In plain English
A high-severity security flaw in Security Optimizer – The All-In-One Protection Plugin from siteground. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 7.5% (higher than 95% of all known vulnerabilities).
Severity (CVSS 3.1)8.1High
Exploit odds (30 days)7.5%top 5.5% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known
Official description
The SiteGround Security plugin for WordPress is vulnerable to authentication bypass that allows unauthenticated users to log in as administrative users due to missing identity verification on the 2FA back-up code implementation that logs users in upon success. This affects versions up to, and including, 1.2.5.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| siteground | Security Optimizer – The All-In-One Protection Plugin | 0 – through 1.2.5 |
Weakness: CWE-285 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H