CVE-2022-1572

The HTML2WP WordPress plugin through 1.0.0 does not have authorisation and CSRF checks in an AJAX action, available to any authenticated users such as subscriber, which could allow them to delete arbitrary file

Score

CVSS 3.1 8.1 High

Status

Modified - contact@wpscan.com

Published

2022-06-27

Last modified

2024-08-03

Weaknesses

CWE-352, CWE-862

Affected products

• Html2wp (Html2wp Project)
• Html2wp (Unknown)

References

• https://wpscan.com/vulnerability/9afd1805-d449-4551-986a-f92cb47c95c5