CVE-2022-4305critical

CVE-2022-4305: critical vulnerability in Login as User or Customer

Login as User or Customer < 3.3 - Unauthenticated Privilege Escalation to Admin

Published · Updated

Follow this CVE+ Monitor Login as User or Customer

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

75Vexday Risk Score

Patch soon. It has a working public exploit.

ssvc Attendcvss 9.8epss 39%
The Login as User or Customer WordPress plugin before 3.3 lacks authorization checks to ensure that users are allowed to log in as another one, which could allow unauthenticated attackers to obtain a valid admin session.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected products
Unknown · Login as User or Customer
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Related CVEs — Login as User or Customer

In the same product, most dangerous first.

CVE-2023-7247MEDIUMLogin as User or Customer <= 3.8 - Admin Account TakeoverEPSS 0.6%