CVEvulnerability

CVE-2022-3419

6.5 MEDIUM Published 2022-10-31 Modified 2026-06-17 Official page ↗
Status
Modified
Published
2022-10-31
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.1 ([email protected])
6.5 MEDIUM — CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
CVSS 3.1 (134c704f-9b21-4f2e-91b3-4a467353bcc0)
6.5 MEDIUM — CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Weaknesses
CWE-269, CWE-352

Description

The Automatic User Roles Switcher WordPress plugin before 1.1.2 does not have authorisation and proper CSRF checks, allowing any authenticated users like subscriber to add any role to themselves, such as administrator

Affected configurations

• addify automatic user roles switcher (< 1.1.2)

Related

Weakness · CWE (2)

  • CWE-269 Improper Privilege Management weakness
  • CWE-352 Cross-Site Request Forgery weakness

References