CVE-2022-1788

Due to missing checks the Change Uploaded File Permissions WordPress plugin through 4.0.0 is vulnerable to CSRF attacks. This can be used to change the file and folder permissions of any folder. This could be problematic when specific files like ini files are made readable for everyone due to this.

CVSS v3.1

6.5 MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

CVSS v2.0

4.3 MEDIUMAV:N/AC:M/Au:N/C:N/I:P/A:N

EPSS

0.77% chance of exploitation in the next 30 days, 53th percentile

Published

2022-06-13

Updated

2024-08-03

Proof-of-concept exploits (1)

• https://wpscan.com/vulnerability/c39719e5-dadd-4414-a96d-5e70a1e3d462

References

• CVE Record
• NVD entry

Related

• CVE-2022-1787
• CVE-2022-1790
• CVE-2022-1786
• CVE-2022-1791
• CVE-2022-1785
• CVE-2022-1792