CVE-2022-33969
WordPress Flipbox plugin <= 2.6.0 - Authenticated WordPress Options Change vulnerability
Summary
Descriptions
Authenticated WordPress Options Change vulnerability in Biplob Adhikari's Flipbox plugin <= 2.6.0 at WordPress.
Una vulnerabilidad de Cambio de Opciones de WordPress Autenticado en el plugin Flipbox de Biplob Adhikari versiones anteriores a 2.6.0 incluyéndola en WordPress
The Flipbox – Awesomes Flip Boxes Image Overlay plugin for WordPress is vulnerable to arbitrary options updates in versions up to, and including, 2.6.0. This is due to a lack of validation on the settings supplied to the oxi_settings() function. This makes it possible for authenticated attackers, with administrative level permissions, to update arbitrary options on the WordPress site. This would only affect sites where the administrator has been restricted to not 'manage_options' or the administrator has allowed users with lower permissions to update the plugin's settings.
CVSS Scores
SSVC
- Decision:Track*
Timeline
- 2022-07-22 CVE Reserved
- 2022-07-25 CVE Published
- 2024-02-15 EPSS Updated
- 2025-02-20 CVE Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
- ---------- First Exploit
CWE
- CWE-264: Permissions, Privileges, and Access Controls
- CWE-639: Authorization Bypass Through User-Controlled Key
CAPEC
Threat Intelligence Resources (0)
| Select | Title | Date |
|---|
Select an advisory to view details here.
| Select | Title | Date |
|---|
Select an exploit to view details here.
References (2)
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|