CVE-2022-4309
Subscribe2 < 10.38 - User Deletion via CSRF
LOW 3.1EPSS 0.2%
The Subscribe2 WordPress plugin before 10.38 does not have CSRF check when deleting users, which could allow attackers to make a logged in admin delete arbitrary users by knowing their email via a CSRF attack.
- Affected
- Subscribe2
- CVSS v3.1 NVD
- 3.1 LOW
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N - EPSS
- 0.24% chance of exploitation in the next 30 days, 14th percentile
- Published
- 2023-01-16
- Updated
- 2025-04-07