CVE-2022-0191

MEDIUM

Ad Invalid Click Protector < 1.2.7 - Cross-Site Request Forgery in Ban Deletion

Title source: llm
STIX 2.1

Description

The Ad Invalid Click Protector (AICP) WordPress plugin before 1.2.7 does not have CSRF check deleting banned users, which could allow attackers to make a logged in admin remove arbitrary bans

References (2)

Core 2
Core References
Exploit, Third Party Advisory x_refsource_misc
https://wpscan.com/vulnerability/d4c32a02-810f-43d8-946a-b7e18ac54f55
Patch, Third Party Advisory x_refsource_confirm
https://plugins.trac.wordpress.org/changeset/2705068

Scores

CVSS v3 6.5
EPSS 0.0056
EPSS Percentile 42.6%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

Details

CWE
CWE-352
Status published
Products (1)
acnam/ad_invalid_click_protector < 1.2.7
Published May 02, 2022
Tracked Since Feb 18, 2026