CVE-2022-0199

The Coming soon and Maintenance mode WordPress plugin before 3.6.8 does not have CSRF check in its coming_soon_send_mail AJAX action, allowing attackers to make logged in admin to send arbitrary emails to all subscribed users via a CSRF attack

Score

CVSS 3.1 4.3 Medium

Status

Modified - contact@wpscan.com

Published

2022-02-21

Last modified

2024-08-02

Weaknesses

CWE-352

Affected products

• Coming Soon And Maintenance Mode (Unknown)
• Coming Soon And Maintenance Mode (Wpdevart)

References

• https://plugins.trac.wordpress.org/changeset/2659455
• https://wpscan.com/vulnerability/1ab1748f-c939-4953-83fc-9df878da7714