CVE-2022-4305

The Login as User or Customer WordPress plugin before 3.3 lacks authorization checks to ensure that users are allowed to log in as another one, which could allow unauthenticated attackers to obtain a valid admin session.

CVSS v3.1

9.8 CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CVSS v3.1

9.8 CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS

38.62% chance of exploitation in the next 30 days, 98th percentile

Nuclei

critical · CWE-269

Published

2023-01-23

Updated

2025-04-03

Proof-of-concept exploits (1)

• https://wpscan.com/vulnerability/286d972d-7bda-455c-a226-fd9ce5f925bd

Nuclei templates (1)

• projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-4305.yaml

References

• CVE Record
• NVD entry

Related

• CVE-2022-43046
• CVE-2022-4306
• CVE-2022-43045
• CVE-2022-4307
• CVE-2022-43044
• CVE-2022-43071