CVE-2022-29417: WordPress ShortPixel Adaptive Images plugin <= 3.3.1 - Subscriber+ Plugin Settings Update vulnerability
First published: Mon Apr 25 2022(Updated: )
Plugin Settings Update vulnerability in ShortPixel's ShortPixel Adaptive Images plugin <= 3.3.1 at WordPress allows an attacker with a low user role like a subscriber or higher to change the plugin settings.
Credit: audit@patchstack.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| ShortPixel Adaptive Images | <=3.3.1 |
Remedy
Update to 3.4.0 or higher version.
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the vulnerability ID for the Plugin Settings Update vulnerability in ShortPixel's ShortPixel Adaptive Images plugin?
The vulnerability ID is CVE-2022-29417.
What is the affected software for the Plugin Settings Update vulnerability?
The affected software is ShortPixel's ShortPixel Adaptive Images plugin version <= 3.3.1 at WordPress.
What is the severity of the Plugin Settings Update vulnerability?
The severity of the vulnerability is medium with a CVSS score of 4.3.
How can an attacker exploit the Plugin Settings Update vulnerability?
An attacker with a low user role like a subscriber or higher can exploit the vulnerability to change the plugin settings.
Are there any patches or fixes available for the Plugin Settings Update vulnerability?
Yes, patches and fixes are available. You can find them at the following references: [Patchstack](https://patchstack.com/database/vulnerability/shortpixel-adaptive-images/wordpress-shortpixel-adaptive-images-plugin-3-3-1-subscriber-plugin-settings-update-vulnerability) and [WordPress Plugin Directory](https://wordpress.org/plugins/shortpixel-adaptive-images/#developers).
- agent/type
- agent/references
- agent/author
- agent/softwarecombine
- collector/mitre-cve
- source/MITRE
- agent/severity
- agent/title
- agent/last-modified-date
- agent/weakness
- agent/remedy
- agent/event
- agent/first-publish-date
- agent/description
- agent/source
- agent/tags
- collector/nvd-api
- agent/software-canonical-lookup-request
- collector/nvd-index
- vendor/shortpixel
- canonical/shortpixel adaptive images
- version/shortpixel adaptive images/3.3.1