CVE-2022-1570

MEDIUM

Files Download Delay < 1.0.7 - Authenticated Missing Authorization for Settings Reset

Title source: llm
STIX 2.1

Description

The Files Download Delay WordPress plugin before 1.0.7 does not have authorisation and CSRF checks when reseting its settings, which could allow any authenticated users, such as subscriber to perform such action.

References (1)

Core 1
Core References
Exploit, Third Party Advisory exploit vdb-entry technical-description
https://wpscan.com/vulnerability/c0257564-48ee-4d02-865f-82c8b5e793c9

Scores

CVSS v3 6.5
EPSS 0.0041
EPSS Percentile 32.5%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Details

CWE
CWE-352 CWE-862
Status published
Products (1)
files_download_delay_project/files_download_delay < 1.0.7
Published Jun 08, 2022
Tracked Since Feb 18, 2026