CVE-2022-1599
Admin Management Xtended < 2.4.5 - Post Visibility/Date/Comment Status Update via CSRF
- State
- Published
- Severity
- Not scored
- Published
- Jul 11, 2022
- Updated
- Aug 3, 2024
- Reserved
- May 5, 2022
Description
The Admin Management Xtended WordPress plugin before 2.4.5 does not have CSRF checks in some of its AJAX actions, allowing attackers to make a logged users with the right capabilities to call them. This can lead to changes in post status (draft, published), slug, post date, comment status (enabled, disabled) and more.
Scores
The record has no CVSS score.
Weaknesses
- CWE-352 Cross-Site Request Forgery (CSRF)
Affected Products
| Product | Versions |
|---|---|
Admin Management XtendedUnknown |
|
References
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.