vulnwire
6.5med

CVE-2022-1663

Stop Spam Comments <= 0.2.1.2 - Access Token Bypass

Published 4 y ago · modified 4 mo ago · JSON

CVSS
6.5
v3.1 · NVD
CISA KEV
No
not known exploited
EPSS
0.7%
percentile 52%
Public exploits
0
none known

The Stop Spam Comments WordPress plugin through 0.2.1.2 does not properly generate the Javascript access token for preventing abuse of comment section, allowing threat authors to easily collect the value and add it to the request.

Exploit prediction (EPSS)

0.68% probability of exploitation in the next 30 days, higher than 52% of all scored CVEs.

CVSS scores

Assigned byVersionScoreVector
NVD3.16.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Affected products

  • Unknown Stop Spam Comments

Classification

Weakness
  • CWE-200 Exposure of Sensitive Information to an Unauthorized Actor

References

  • wpscan.com /vulnerability/30820be1-e96a-4ff6-b1ec-efda14069e70 · x_refsource_MISC, x_transferred

Sources

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.