CVE-2022-3883

MEDIUM

stopbadbots < 7.24 - Authenticated Arbitrary Plugin Installation via AJAX Action

Title source: llm
STIX 2.1

Description

The Block Bad Bots and Stop Bad Bots Crawlers and Spiders and Anti Spam Protection WordPress plugin before 7.24 does not have proper authorisation and CSRF in an AJAX action, allowing any authenticated users, such as subscriber to call it and install and activate arbitrary plugins from wordpress.org

References (1)

Core 1
Core References
Exploit, Third Party Advisory exploit vdb-entry technical-description
https://wpscan.com/vulnerability/8695b157-abac-4aa6-a022-e3ae41c03544

Scores

CVSS v3 6.5
EPSS 0.0033
EPSS Percentile 24.4%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

CISA SSVC

Vulnrichment
Exploitation poc
Automatable no
Technical Impact partial

Details

CWE
CWE-352 CWE-863
Status published
Products (1)
stopbadbots_project/stopbadbots < 7.24
Published Dec 12, 2022
Tracked Since Feb 18, 2026