CVE-2022-3097

The Plugin LBstopattack WordPress plugin before 1.1.3 does not use nonces when saving its settings, making it possible for attackers to conduct CSRF attacks. This could allow attackers to disable the plugin's protections.

CVSS v3.1

6.5 MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

CVSS v3.1

6.5 MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

EPSS

0.36% chance of exploitation in the next 30 days, 29th percentile

Published

2022-10-25

Updated

2025-05-07

Proof-of-concept exploits (1)

• https://wpscan.com/vulnerability/9ebb8318-ebaf-4de7-b337-c91327685a43

References

• CVE Record
• NVD entry

Related

• CVE-2022-3096
• CVE-2022-30974
• CVE-2022-30929
• CVE-2022-30975
• CVE-2022-30927
• CVE-2022-30976