CVE-2022-2260: GiveWP < 2.21.3 - DoS via CSRF
The GiveWP WordPress plugin before 2.21.3 does not have CSRF in place when exporting data, and does not validate the exporting parameters such as dates, which could allow attackers to make a logged in admin DoS the web server via a CSRF attack as the plugin will try to retrieve data from the database many times which leads to overwhelm the target's CPU.
Affected Software
Event History
Frequently Asked Questions
What is CVE-2022-2260?
CVE-2022-2260 is a vulnerability in the GiveWP WordPress plugin before 2.21.3 that allows attackers to perform a Denial of Service (DoS) attack on the web server via a CSRF attack.
How severe is CVE-2022-2260?
CVE-2022-2260 has a severity rating of 6.5 out of 10 (medium severity).
How does CVE-2022-2260 impact the GiveWP WordPress plugin?
CVE-2022-2260 impacts the GiveWP WordPress plugin before version 2.21.3, allowing attackers to make a logged in admin DoS the web server via a CSRF attack.
How can the GiveWP WordPress plugin be fixed to address CVE-2022-2260?
To fix CVE-2022-2260, update the GiveWP WordPress plugin to version 2.21.3 or newer.
What is the Common Weakness Enumeration (CWE) ID for CVE-2022-2260?
CVE-2022-2260 is associated with CWE ID 352.