CVE-2022-4309

EUVD-2022-51664
The Subscribe2 WordPress plugin before 10.38 does not have CSRF check when deleting users, which could allow attackers to make a logged in admin delete arbitrary users by knowing their email via a CSRF attack.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
3.1 LOW
NETWORK
HIGH
NONE
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N
CISA-ADPADP
3.1 LOW
NETWORK
HIGH
NONE
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N
Base Score
CVSS 3.x
EPSS Score
Percentile: 26%
Affected Products (NVD)
VendorProductVersion
subscribe2_projectsubscribe2
𝑥
< 10.38
𝑥
= Vulnerable software versions
References
https://wpscan.com/vulnerability/1965f53d-c94e-4322-9059-49de69df1051
https://wpscan.com/vulnerability/1965f53d-c94e-4322-9059-49de69df1051