CVE-2022-3622: Blog2Social <= 6.9.11 - Missing Authorization to Authenticated (Subscriber+) Settings Update
The Blog2Social plugin for WordPress is vulnerable to authorization bypass due to missing capability checks in versions up to, and including, 6.9.11. This makes it possible for authenticated attackers, with subscriber-level permissions and above, to change some plugin settings intended to be modifiable by admins only.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is CVE-2022-3622?
CVE-2022-3622 is a vulnerability in the Blog2Social plugin for WordPress that allows authenticated attackers with subscriber-level permissions and above to change certain plugin settings.
What is the severity of CVE-2022-3622?
The severity of CVE-2022-3622 is medium with a CVSS score of 4.7.
How does CVE-2022-3622 impact Blog2Social plugin users?
CVE-2022-3622 allows authenticated attackers to bypass authorization and modify plugin settings, potentially affecting the functionality and security of the Blog2Social plugin.
Which versions of Blog2Social plugin are affected by CVE-2022-3622?
Versions up to and including 6.9.11 of the Blog2Social plugin for WordPress are affected by CVE-2022-3622.
How can I fix CVE-2022-3622 vulnerability?
To fix the CVE-2022-3622 vulnerability, it is recommended to update the Blog2Social plugin to a version beyond 6.9.11, which includes the necessary capability checks to prevent authorization bypass.