CVE-2022-0218

HIGHNuclei

WP HTML Mail <= 3.0.9 Missing Authorization on REST-API Route

Title source: CVE List
STIX 2.1 vulnerability

Record summary

CVE-2022-0218 has a selected CVSS score of 8.3 (high); EIP currently links 1 Nuclei template.

Description

The WP HTML Mail WordPress plugin is vulnerable to unauthorized access which allows unauthenticated attackers to retrieve and modify theme settings due to a missing capability check on the /themesettings REST-API endpoint found in the ~/includes/class-template-designer.php file, in versions up to and including 3.0.9. This makes it possible for attackers with no privileges to execute the endpoint and add malicious JavaScript to a vulnerable WordPress site.

Description source: CVE List

Exploitation context

Known exploitation

VulnCheck KEV
Listed · Jan 13, 2022 · VulnCheck
Reported exploitation
Observed · VulnCheck

Available material

Nuclei templates
1

CISA SSVC decision

ExploitationNone
AutomatableYes
Technical impactPartial

CISA Coordinator · SSVC 2.0.3 · Evaluated Feb 10, 2025 · Source: CVE List

Affected products and versions

2
ProductSourceVersion range

WP HTML Mail

Browse codemiq / WP HTML Mail
CVE List3.0.9 to ≤ 3.0.9affected

wordpress_email_template_designer

Browse codemiq / wordpress_email_template_designer
VulnCheckVersion data not supplied

Nuclei templates

1
ProjectDiscoveryMEDIUMHTML Email Template Designer < 3.1 - Missing Authorization on Rest RouteCVSS 6.1

The WP HTML Mail WordPress plugin is vulnerable to unauthorized access which allows unauthenticated attackers to retrieve and modify theme settings due to a missing capability check on the /themesettings REST-API endpoint found in the ~/includes/class-template-designer.php file, in versions up to and including 3.0.9. This makes it possible for attackers with no privileges to execute the endpoint and add malicious JavaScript to a vulnerable WordPress site.

Impact

An attacker can exploit this vulnerability to inject malicious scripts into the subject field of an email template, potentially leading to unauthorized access, data theft, or further compromise of the affected system.

Remediation

Update to version 3.1 or later of the HTML Email Template Designer plugin to fix the vulnerability.

WeaknessesCWE-79
Authorshexcat
Template tagscvecve2022wordpresswp-plugincodemiqvkevvuln
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CPE: cpe:2.3:a:codemiq:wordpress_email_template_designer:*:*:*:*:*:wordpress:*:*
https://www.wordfence.com/blog/2022/01/unauthenticated-xss-vulnerability-patched-in-html-email-template-designer-plugin/ https://wordpress.org/plugins/wp-html-mail/ https://nvd.nist.gov/vuln/detail/CVE-2022-0218 https://plugins.trac.wordpress.org/changeset/2656984/wp-html-mail/trunk/includes/class-template-designer.php https://github.com/ARPSyndicate/cvemon

Source: ProjectDiscovery

References

3