The Ask me WordPress theme before 6.8.4 does not perform nonce checks when processing POST requests to the Edit Profile page, allowing an attacker to trick a user to change their profile information by sending a crafted request.
References
| Link | Resource |
|---|---|
| https://wpscan.com/vulnerability/34b3fc35-381a-4bd7-87e3-f1ef0a15a349 | Exploit Third Party Advisory |
| https://wpscan.com/vulnerability/34b3fc35-381a-4bd7-87e3-f1ef0a15a349 | Exploit Third Party Advisory |
Configurations
History
21 Nov 2024, 06:40
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://wpscan.com/vulnerability/34b3fc35-381a-4bd7-87e3-f1ef0a15a349 - Exploit, Third Party Advisory |
23 Aug 2022, 18:44
| Type | Values Removed | Values Added |
|---|---|---|
| References | (MISC) https://wpscan.com/vulnerability/34b3fc35-381a-4bd7-87e3-f1ef0a15a349 - Exploit, Third Party Advisory | |
| CPE | cpe:2.3:a:inkthemes:ask_me:*:*:*:*:*:wordpress:*:* | |
| CWE | CWE-352 | |
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 4.3 |
22 Aug 2022, 16:35
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2022-08-22 15:15
Updated : 2024-11-21 06:40
NVD link : CVE-2022-1251
Mitre link : CVE-2022-1251
CVE.ORG link : CVE-2022-1251
JSON object : View
Products Affected
inkthemes
- ask_me
CWE
CWE-352
Cross-Site Request Forgery (CSRF)