CVE-2022-3911: iubenda < 3.3.3 - Subscriber+ Privileges Escalation to Admin
The iubenda WordPress plugin before 3.3.3 does does not have authorisation and CSRF in an AJAX action, and does not ensure that the options to be updated belong to the plugin as long as they are arrays. As a result, any authenticated users, such as subscriber can grant themselves any privileges, such as editplugins etc
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2022-3911?
CVE-2022-3911 has a medium severity due to the potential for authenticated users to modify options unauthorizedly.
How do I fix CVE-2022-3911?
To fix CVE-2022-3911, update the iubenda WordPress plugin to version 3.3.3 or later.
Who is affected by CVE-2022-3911?
CVE-2022-3911 affects authenticated users, including subscribers, of the iubenda WordPress plugin.
What type of vulnerability is CVE-2022-3911?
CVE-2022-3911 is a CSRF and authorization vulnerability in an AJAX action.
What can attackers do with CVE-2022-3911?
Attackers exploiting CVE-2022-3911 can grant themselves unauthorized administrative privileges.