CVE-2022-50955

WordPress Plugin Curtain 1.0.2 Cross-site Request Forgery

CVSS 5.3 MEDIUMEPSS 0.1%CWE-352

WordPress Plugin Curtain 1.0.2 contains a cross-site request forgery vulnerability that allows attackers to activate or deactivate site maintenance mode by crafting malicious requests. Attackers can trick authenticated administrators into submitting forged requests to the options-general.php page with curtain parameters to toggle maintenance mode without valid nonce validation.

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:L/SI:L/SA:L

Affected products

curtain · Curtain

public PoCs found — 1

cve_referencewww.exploit-db.com/exploits/50842unverified

⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.

Want to know if your infrastructure is exposed to this?

Talk to TrueHacking →

References

https://wordpress.org/plugins/curtain/https://www.exploit-db.com/exploits/50842 https://www.vulncheck.com/advisories/wordpress-plugin-curtain-cross-site-request-forgery