Vulnerability · Published Apr 19, 2022 · Assigned by Wordfence
CVE-2022-0992SiteGround Security <= 1.2.5 - Authentication Bypass via 2FA Setup
Critical 9.8
In plain English
A critical-severity authentication bypass in Security Optimizer – The All-In-One Protection Plugin from siteground. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 2.9% (higher than 87% of all known vulnerabilities).
Official description
The SiteGround Security plugin for WordPress is vulnerable to authentication bypass that allows unauthenticated users to log in as administrative users due to missing identity verification on initial 2FA set-up that allows unauthenticated and unauthorized users to configure 2FA for pending accounts. Upon successful configuration, the attacker is logged in as that user without access to a username/password pair which is the expected first form of authentication. This affects versions up to, and including, 1.2.5.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| siteground | Security Optimizer – The All-In-One Protection Plugin | 0 – through 1.2.5 |
Weakness: CWE-288, CWE-306 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H