CVE-2022-0188

Coming Soon & Maintenance Plugin by NiteoThemes < 4.0.19 - Unauthenticated Arbitrary CSS Update

The CMP WordPress plugin before 4.0.19 allows any user, even not logged in, to arbitrarily change the coming soon page layout.

Affected

CMP

CVSS v3.1 NVD

5.3 MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

CVSS v2.0 NVD

5.0 MEDIUMAV:N/AC:L/Au:N/C:N/I:P/A:N

EPSS

2.31% chance of exploitation in the next 30 days, 83rd percentile

Nuclei

medium

Published

2022-02-14

Updated

2024-08-02

Proof-of-concept exploits (1)

• https://wpscan.com/vulnerability/50b6f770-6f53-41ef-b2f3-2a58e9afd332

Nuclei templates (1)

• projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-0188.yaml

Security advisories

• https://plugins.trac.wordpress.org/changeset/2657597/cmp-coming-soon-maintenance

References

• CVE Record
• NVD entry