CVE-2022-0681: Simple Membership < 4.1.0 - Arbitrary Transaction Deletion via CSRF
The Simple Membership WordPress plugin before 4.1.0 does not have CSRF check in place when deleting Transactions, which could allow attackers to make a logged in admin delete arbitrary transactions via a CSRF attack
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2022-0681?
CVE-2022-0681 is considered a high severity vulnerability due to the potential for authenticated attackers to exploit it.
How do I fix CVE-2022-0681?
To resolve CVE-2022-0681, update the Simple Membership plugin to version 4.1.0 or later.
What is the impact of CVE-2022-0681?
CVE-2022-0681 allows attackers to delete arbitrary transactions without proper authorization through a CSRF attack.
Who is affected by CVE-2022-0681?
Any WordPress site using Simple Membership plugin versions prior to 4.1.0 is vulnerable to CVE-2022-0681.
Is CVE-2022-0681 a type of CSRF vulnerability?
Yes, CVE-2022-0681 is specifically a Cross-Site Request Forgery (CSRF) vulnerability related to transaction deletion.