CVE-2022-1203
Medium
Description
The Content Mask WordPress plugin before 1.8.4.1 does not have authorisation and CSRF checks in various AJAX actions, as well as does not validate the option to be updated to ensure it belongs to the plugin. As a result, any authenticated user, such as subscriber could modify arbitrary blog options
SeverityMedium
CVSS4.3
Exploit probability—
ProductContent Mask
PublishedMay 30, 2022
First seenMay 30, 2022
How to fix
Update
- content_mask_project content_mask1.8.4.1 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| content_mask_project content_mask | v < 1.8.4.1 | 1.8.4.1 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.