CVE-2022-4305

critical · 9.8

A public exploit / detection template exists

Weaponised detection is publicly available, which meaningfully raises real-world risk regardless of CVSS. nuclei-templates →

The Login as User or Customer WordPress plugin before 3.3 lacks authorization checks to ensure that users are allowed to log in as another one, which could allow unauthenticated attackers to obtain a valid admin session.

9.8

CVSS

38.6%

EPSS (exploit prob.)

99th

EPSS percentile

2023-01-23

Published

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected products

Vendor	Product	Affected versions
wp-buy	login_as_user_or_customer_(user_switching)	< 3.3

Check a specific version with /api/v1/cve/match.

References

https://wpscan.com/vulnerability/286d972d-7bda-455c-a226-fd9ce5f925bd
https://wpscan.com/vulnerability/286d972d-7bda-455c-a226-fd9ce5f925bd

Query this programmatically:

curl https://evil-db.io/api/v1/cve/CVE-2022-4305