CVE-2022-1956

The Shortcut Macros WordPress plugin through 1.3 does not have authorisation and CSRF checks in place when updating its settings, which could allow any authenticated users, such as subscriber, to update them.

CVSS v3.1

4.3 MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

CVSS v2.0

4.0 MEDIUMAV:N/AC:L/Au:S/C:N/I:P/A:N

EPSS

0.34% chance of exploitation in the next 30 days, 27th percentile

Published

2022-07-11

Updated

2024-08-03

Proof-of-concept exploits (1)

• https://wpscan.com/vulnerability/ef6d0393-0ce3-465c-84c8-53bf8c58958a

References

• CVE Record
• NVD entry

Related

• CVE-2022-1955
• CVE-2022-1957
• CVE-2022-1953
• CVE-2022-1960
• CVE-2022-1952
• CVE-2022-1961