CVE-2022-0992
Critical
Description
The SiteGround Security plugin for WordPress is vulnerable to authentication bypass that allows unauthenticated users to log in as administrative users due to missing identity verification on initial 2FA set-up that allows unauthenticated and unauthorized users to configure 2FA for pending accounts. Upon successful configuration, the attacker is logged in as that user without access to a username/password pair which is the expected first form of authentication. This affects versions up to, and including, 1.2.5.
SeverityCritical
CVSS9.8
Exploit probability—
Product
Siteground Security Optimizer
PublishedApr 19, 2022
First seenApr 19, 2022
Weakness typeCWE-288CWE-288
How to fix
Update
- siteground security_optimizer1.2.6 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| siteground security_optimizer | v < 1.2.6 | 1.2.6 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.