CVE-2022-0837: Amelia < 1.0.48 - Customer+ SMS Service Abuse and Sensitive Data Disclosure
The Amelia WordPress plugin before 1.0.48 does not have proper authorisation when handling Amelia SMS service, allowing any customer to send paid test SMS notification as well as retrieve sensitive information about the admin, such as the email, account balance and payment history. A malicious actor can abuse this vulnerability to drain out the account balance by keep sending SMS notification.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2022-0837?
CVE-2022-0837 is considered a high severity vulnerability due to its potential for unauthorized access to sensitive user information.
How do I fix CVE-2022-0837?
To fix CVE-2022-0837, update the Amelia WordPress plugin to version 1.0.48 or later.
What types of information could be exposed by CVE-2022-0837?
CVE-2022-0837 could expose sensitive information such as the admin's email, account balance, and payment history.
Who is affected by CVE-2022-0837?
Users of the Amelia WordPress plugin prior to version 1.0.48 are affected by CVE-2022-0837.
Can CVE-2022-0837 be exploited by regular customers?
Yes, CVE-2022-0837 allows any customer to send paid test SMS notifications and access unauthorized information.