Monitor free

Report

New Known

Verified

Fixed

WordPress ActiveDEMAND plugin <= 0.2.27 - Broken Authentication vulnerability

6.5

CVSS 3.1 score Medium severity

Report

Monitoring Not reported to be exploited

Find out about vulnerable plugins in your websites for free.

Scan your website

Software

ActiveDEMAND

Type

Plugin

Vulnerable versions

<= 0.2.27

Fixed in

0.2.28

PSID

728776ee5641

CVE ID

CVE-2022-36296

Classification

Broken Authentication

OWASP Top 10

A2: Broken Authentication

Required privilege

Can be exploited remotely without any authentication.

Credits

Tien Nguyen Anh (Patchstack Alliance)

Publicly disclosed

2022-08-02

Patchstack vPatch available since

09.12.2021

Details

Broken Authentication vulnerability leading to unauthenticated post update/create/delete discovered by Tien Nguyen Anh (Patchstack Alliance) in WordPress ActiveDEMAND plugin (versions <= 0.2.27).

Solution

Update the WordPress ActiveDEMAND plugin to the latest available version (at least 0.2.28).

References