CVE-2022-2276

WP Edit Menu < 1.5.0 - Unauthenticated Arbitrary Post Deletion

The WP Edit Menu WordPress plugin before 1.5.0 does not have authorisation and CSRF in an AJAX action, which could allow unauthenticated attackers to delete arbitrary posts/pages from the blog

Affected

WP Edit Menu

CVSS v3.1 NVD

4.3 MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

EPSS

0.41% chance of exploitation in the next 30 days, 34th percentile

Published

2022-08-22

Updated

2024-08-03

Proof-of-concept exploits (1)

• https://wpscan.com/vulnerability/92de9c1b-48dd-4a5f-bbb3-455f8f172b09

Security advisories

• https://plugins.trac.wordpress.org/changeset?new=2749780%40wp-edit-menu%2Ftrunk&old=22201…

References

• CVE Record
• NVD entry