CVE-2022-0229

The miniOrange's Google Authenticator WordPress plugin before 5.5 does not have proper authorisation and CSRF checks when handling the reconfigureMethod, and does not validate the parameters passed to it properly. As a result, unauthenticated users could delete arbitrary options from the blog, making it unusable.

Score

CVSS 3.1 8.1 High

Status

Modified - contact@wpscan.com

Published

2022-03-21

Last modified

2024-08-02

Weaknesses

CWE-352, CWE-862

Affected products

• Google Authenticator (Miniorange)
• Minioranges Google Authenticator (Unknown)

References

• https://wpscan.com/vulnerability/d70c5335-4c01-448d-85fc-f8e75b104351