CVE-2022-0218highexplotación observadaCWE-79CWE-862

CVE-2022-0218: fallo de gravedad alta en codemiq WP HTML Mail

WP HTML Mail <= 3.0.9 Missing Authorization on REST-API Route

Publicada el · Actualizada el

Seguir esta CVE+ Monitorear WP HTML Mail

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

70Vexday Risk Score

Corrige ahora. Ella explotación observada por VulnCheck y tiene exploit funcional público.

ssvc Actcvss 8.3epss 66%
de la publicación al arma
Publicada en NVD4 feb
VulnCheck13 ene
The WP HTML Mail WordPress plugin is vulnerable to unauthorized access which allows unauthenticated attackers to retrieve and modify theme settings due to a missing capability check on the /themesettings REST-API endpoint found in the ~/includes/class-template-designer.php file, in versions up to and including 3.0.9. This makes it possible for attackers with no privileges to execute the endpoint and add malicious JavaScript to a vulnerable WordPress site.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L
Productos afectados
codemiq · WP HTML Mail