CVE-2022-4553

MEDIUM

FL3R FeelBox < 8.1 - Cross-Site Request Forgery via Mood Reset Action

Title source: llm

Description

The FL3R FeelBox WordPress plugin through 8.1 does not have CSRF check when updating reseting moods which could allow attackers to make logged in admins perform such action via a CSRF attack and delete the lydl_posts & lydl_poststimestamp DB tables

References (1)

Core 1

Core References

Exploit, Third Party Advisory exploit vdb-entry technical-description

https://wpscan.com/vulnerability/483ed482-a1d1-44f6-8b99-56e653d3e45f

Scores

CVSS v3 4.3

EPSS 0.0027

EPSS Percentile 18.3%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

CISA SSVC

Vulnrichment

Exploitation poc

Automatable no

Technical Impact partial

Details

CWE

CWE-352

Status published

Products (1)

armandofiore/fl3r_feelbox < 8.1

Published Jan 30, 2023

Tracked Since Feb 18, 2026