CVE-2022-1791

HIGH

One Click Plugin Updater < 2.4.14 - Cross-Site Request Forgery in Settings Update

Title source: llm

Description

The One Click Plugin Updater WordPress plugin through 2.4.14 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack and disable / hide the badge of the available updates and the related check.

References (1)

Core 1

Core References

Exploit, Third Party Advisory x_refsource_misc

https://wpscan.com/vulnerability/5c185269-cb3a-4463-8d73-b190813d4431

Scores

CVSS v3 8.1

EPSS 0.0052

EPSS Percentile 40.1%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H

Details

CWE

CWE-352

Status published

Products (1)

one_click_plugin_updater_project/one_click_plugin_updater < 2.4.14

Published Jun 13, 2022

Tracked Since Feb 18, 2026