Vulnerability · Published Dec 16, 2022 · Assigned by Wordfence
CVE-2022-4555WP Shamsi <= 4.1.0 - Missing Authorization to Arbitrary Plugin Deactivation
Medium 6.5
In plain English
A medium-severity missing authorization in WP Shamsi – افزونه تاریخ شمسی و فارسی ساز وردپرس from wpvar. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.7% (higher than 54% of all known vulnerabilities).
Official description
The WP Shamsi plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on the deactivate() function hooked via init() in versions up to, and including, 4.1.0. This makes it possible for unauthenticated attackers to deactivate arbitrary plugins on the site. This can be used to deactivate security plugins that aids in exploiting other vulnerabilities.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| wpvar | WP Shamsi – افزونه تاریخ شمسی و فارسی ساز وردپرس | 0 – through 4.1.0 |
Weakness: CWE-862 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L
References
- https://www.wordfence.com/threat-intel/vulnerabilities/id/7b498c5a-9fd1-43b8-b456-f6cec65d5077?source=cve
- https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2645044%40wp-shamsi&new=2645044%40wp-shamsi&sfp_email=&sfph_mail=
- https://www.wordfence.com/threat-intel/vulnerabilities/id/7b498c5a-9fd1-43b8-b456-f6cec65d5077 x_transferred