CVE-2022-0313: Float Menu < 4.3.1 - Arbitrary Menu Deletion via CSRF
Published Feb 21, 2022
·Updated
The Float menu WordPress plugin before 4.3.1 does not have CSRF check in place when deleting menu, which could allow attackers to make a logged in admin delete them via a CSRF attack
Affected Software
1 affected component
Wow-estore Float Menu Wordpress<4.3.1
Event History
Feb 21, 2022
CVE Published
via MITRE·10:46 AM
Data Sourced
via MITRE·10:46 AM
DescriptionWeakness
Frequently Asked Questions
1
What is the severity of CVE-2022-0313?
CVE-2022-0313 has a moderate severity due to the potential for an attacker to exploit the CSRF vulnerability to delete menu entries.
2
How do I fix CVE-2022-0313?
To fix CVE-2022-0313, update the Float menu WordPress plugin to version 4.3.1 or higher.
3
What systems are affected by CVE-2022-0313?
CVE-2022-0313 affects vulnerable versions of the Float menu WordPress plugin prior to 4.3.1.
4
Is authentication required to exploit CVE-2022-0313?
Yes, exploitation of CVE-2022-0313 requires the attacker to have an authenticated session with admin privileges.
5
What type of vulnerability is CVE-2022-0313?
CVE-2022-0313 is a Cross-Site Request Forgery (CSRF) vulnerability that can lead to unauthorized actions on behalf of a logged-in user.