CVE-2022-1599

MEDIUM

Admin Management Xtended < 2.4.5 - Cross-Site Request Forgery in AJAX Actions

Title source: llm
STIX 2.1

Description

The Admin Management Xtended WordPress plugin before 2.4.5 does not have CSRF checks in some of its AJAX actions, allowing attackers to make a logged users with the right capabilities to call them. This can lead to changes in post status (draft, published), slug, post date, comment status (enabled, disabled) and more.

References (1)

Core 1
Core References
Exploit, Third Party Advisory x_refsource_misc
https://wpscan.com/vulnerability/4a36e876-7e3b-4a81-9f16-9ff5fbb20dd6

Scores

CVSS v3 6.5
EPSS 0.0061
EPSS Percentile 44.9%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

Details

CWE
CWE-352
Status published
Products (1)
admin_management_xtended_project/admin_management_xtended < 2.4.5
Published Jul 11, 2022
Tracked Since Feb 18, 2026