CVE-2022-3882
Assigner: WPScan
Published: 2022-12-12T17:54:34.345Z
State: PUBLISHED
title: WP Memory < 2.46 - Subscriber+ Arbitrary Plugin Installation
problemTypes: descriptions: description: CWE-863 Incorrect Authorization
type: CWE
descriptions: description: CWE-352 Cross-Site Request Forgery (CSRF)
type: CWE
affected: vendor: Unknown
product: Memory Usage, Memory Limit, PHP and Server Memory Health Check and Fix Plugin
collectionURL: https://wordpress.org/plugins
versions: status: affected
versionType: custom
version: 0
lessThan: 2.46
defaultStatus: unaffected
descriptions: value: The Memory Usage, Memory Limit, PHP and Server Memory Health Check and Fix Plugin WordPress plugin before 2.46 does not have proper authorisation and CSRF in an AJAX action, allowing any authenticated users, such as subscriber to call it and install and activate arbitrary plugins from wordpress.org
credits: value: Lana Codes
type: finder
source: discovery: EXTERNAL
x_generator: engine: WPScan CVE Generator