CVE-2022-0992: SiteGround Security <= 1.2.5 - Authentication Bypass via 2FA Setup
The SiteGround Security plugin for WordPress is vulnerable to authentication bypass that allows unauthenticated users to log in as administrative users due to missing identity verification on initial 2FA set-up that allows unauthenticated and unauthorized users to configure 2FA for pending accounts. Upon successful configuration, the attacker is logged in as that user without access to a username/password pair which is the expected first form of authentication. This affects versions up to, and including, 1.2.5.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2022-0992?
The severity of CVE-2022-0992 is classified as high due to the potential for unauthenticated users to gain administrative access.
How do I fix CVE-2022-0992?
To fix CVE-2022-0992, update the SiteGround Security plugin to version 1.2.6 or later.
Who is affected by CVE-2022-0992?
CVE-2022-0992 affects users of the SiteGround Security plugin versions prior to 1.2.6 or 1.2.5 for the SiteGround Security product.
What causes CVE-2022-0992?
CVE-2022-0992 is caused by missing identity verification during the initial setup of two-factor authentication.
Can CVE-2022-0992 be exploited remotely?
Yes, CVE-2022-0992 can be exploited remotely, allowing unauthorized access without any prior authentication.