Vulnerability · Published Nov 14, 2022 · Assigned by WPScan
CVE-2022-3538Webmaster Tools Verification <= 1.2 - Unauthenticated Arbitrary Plugin Deactivation
Medium 6.5
In plain English
A medium-severity missing authorization in Webmaster Tools Verification from Unknown. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 33% of all known vulnerabilities).
Severity (CVSS 3.1)6.5Medium
Exploit odds (30 days)0.4%top 67.5% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known
Official description
The Webmaster Tools Verification WordPress plugin through 1.2 does not have authorisation and CSRF checks when disabling plugins, allowing unauthenticated users to disable arbitrary plugins
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Unknown | Webmaster Tools Verification | 1.2 – through 1.2 |
Weakness: CWE-862, CWE-352 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N