CVE-2022-0616: Amelia < 1.0.46 - Arbitrary Customer Deletion via CSRF
Published Mar 21, 2022
·Updated
The Amelia WordPress plugin before 1.0.47 does not have CSRF check in place when deleting customers, which could allow attackers to make a logged in admin delete arbitrary customers via a CSRF attack
Affected Software
1 affected component
Tms-outsource Amelia Wordpress<1.0.47
Event History
Mar 21, 2022
CVE Published
via MITRE·06:55 PM
Data Sourced
via MITRE·06:55 PM
DescriptionWeakness
Frequently Asked Questions
1
What is the severity of CVE-2022-0616?
CVE-2022-0616 has a medium severity level due to the potential for CSRF attacks against WordPress admin accounts.
2
How do I fix CVE-2022-0616?
To mitigate CVE-2022-0616, upgrade the Amelia WordPress plugin to version 1.0.47 or later.
3
Who is affected by CVE-2022-0616?
Any WordPress site using the Amelia plugin version prior to 1.0.47 is vulnerable to CVE-2022-0616.
4
What kind of attack does CVE-2022-0616 exploit?
CVE-2022-0616 allows attackers to perform Cross-Site Request Forgery (CSRF) attacks that can delete arbitrary customer accounts.
5
Is user authentication required to exploit CVE-2022-0616?
Yes, a valid admin session is required to exploit CVE-2022-0616 through a CSRF attack.