CVEvulnerability

CVE-2022-1967

6.5 MEDIUM Published 2022-07-04 Modified 2026-06-17 Official page ↗
Status
Modified
Published
2022-07-04
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.1 ([email protected])
6.5 MEDIUM — CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
CVSS 2.0 ([email protected])
4.3 MEDIUM — AV:N/AC:M/Au:N/C:N/I:P/A:N
Weaknesses
CWE-352

Description

The WP Championship WordPress plugin before 9.3 is lacking CSRF checks in various places, allowing attackers to make a logged in admin perform unwanted actions, such as create and delete arbitrary teams as well as update the plugin's settings. Due to the lack of sanitisation and escaping, it could also lead to Stored Cross-Site Scripting issues

Affected configurations

• wp-championship project wp-championship (< 9.3)

Related

Weakness · CWE (1)

  • CWE-352 Cross-Site Request Forgery weakness

References