CVE-2022-2245

Counter Box < 1.2.1 - Arbitrary Counter Activation/Deactivation via CSRF

The Counter Box WordPress plugin before 1.2.1 is lacking CSRF check when activating and deactivating counters, which could allow attackers to make a logged in admin perform such actions via CSRF attacks

Affected

Counter Box – WordPress plugin for countdown, timer, counter

CVSS v3.1 NVD

8.8 HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

EPSS

0.53% chance of exploitation in the next 30 days, 44th percentile

Published

2022-08-01

Updated

2024-08-03

Proof-of-concept exploits (1)

• https://wpscan.com/vulnerability/33705003-1f82-4b0c-9b4b-d4de75da309c

References

• CVE Record
• NVD entry